SIZE contest - 0xdapper's results

Lines of code

https://github.com/code-423n4/2022-11-size/blob/main/src/SizeSealed.sol#L415-L440 https://github.com/code-423n4/2022-11-size/blob/main/src/SizeSealed.sol#L156-L159

Vulnerability details

Impact

• Prevents bidders from participating in an auction
• Prevents sellers from getting valid bids

Proof of Concept

There is a limit to number of bids per auction. The attacker can place bid and cancel bids recursively to fill up the bids array preventing the seller from getting any valid bids and having to redo the auction all over again. This can also be used to prevent users from being able to participate in an auction essentially creating a DoS attack.

Pseudo code:

contract Grief {
  function grief() {
    quoteToken.approve(sizeSealed, type(uint).max);
    for (uint i = 0; i < 1000; i++) {
      uint bidId = sizeSealed.bid(...);
      sizeSealed.cancelBid(auctionId, bidId);
    }
  }
}

Tools Used

Recommended Mitigation Steps

Delete cancelled bids from the bids array.