NextGen - 8olidity's results

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/main/smart-contracts/AuctionDemo.sol#L104-L130

Vulnerability details

Impact

The highest bidder can immediately execute cancelBid after successfully executing claimAuction

Proof of Concept

In the claimAuction function, the current block.timestamp is used to check if the auction has ended. If the highest bidder executes cancelBid immediately after claimAuction, the block.timestamp condition is still true, thus allowing cancellation of the bid.

function claimAuction(uint256 _tokenid) public WinnerOrAdminRequired(_tokenid,this.claimAuction.selector){
      require(block.timestamp >= minter.getAuctionEndTime(_tokenid) && auctionClaim[_tokenid] == false && minter.getAuctionStatus(_tokenid) == true);
      auctionClaim[_tokenid] = true;
      uint256 highestBid = returnHighestBid(_tokenid);
      address ownerOfToken = IERC721(gencore).ownerOf(_tokenid);
      address highestBidder = returnHighestBidder(_tokenid);
      for (uint256 i=0; i< auctionInfoData[_tokenid].length; i ++) {
          if (auctionInfoData[_tokenid][i].bidder == highestBidder && auctionInfoData[_tokenid][i].bid == highestBid && auctionInfoData[_tokenid][i].status == true) {
              IERC721(gencore).safeTransferFrom(ownerOfToken, highestBidder, _tokenid);
              (bool success, ) = payable(owner()).call{value: highestBid}("");
              emit ClaimAuction(owner(), _tokenid, success, highestBid);
          } else if (auctionInfoData[_tokenid][i].status == true) {
              (bool success, ) = payable(auctionInfoData[_tokenid][i].bidder).call{value: auctionInfoData[_tokenid][i].bid}("");
              emit Refund(auctionInfoData[_tokenid][i].bidder, _tokenid, success, highestBid);
          } else {}
      }
  }

  // cancel a single Bid

  function cancelBid(uint256 _tokenid, uint256 index) public {
      require(block.timestamp <= minter.getAuctionEndTime(_tokenid), "Auction ended");
      require(auctionInfoData[_tokenid][index].bidder == msg.sender && auctionInfoData[_tokenid][index].status == true);
      auctionInfoData[_tokenid][index].status = false;
      (bool success, ) = payable(auctionInfoData[_tokenid][index].bidder).call{value: auctionInfoData[_tokenid][index].bid}("");
      emit CancelBid(msg.sender, _tokenid, index, success, auctionInfoData[_tokenid][index].bid);
  }

Tools Used

vscode

Recommended Mitigation Steps

It is recommended to consider modifying the code to prevent the highest bidder from canceling the bid after claiming the auction, or to adjust the corresponding logic according to needs.

Assessed type

Other