Revolution Protocol - Franklin's results

Lines of code

https://github.com/code-423n4/2023-12-revolutionprotocol/blob/d42cc62b873a1b2b44f57310f9d4bbfdd875e8d6/packages/revolution/src/AuctionHouse.sol#L287 https://github.com/code-423n4/2023-12-revolutionprotocol/blob/d42cc62b873a1b2b44f57310f9d4bbfdd875e8d6/packages/revolution/src/AuctionHouse.sol#L297 https://github.com/code-423n4/2023-12-revolutionprotocol/blob/d42cc62b873a1b2b44f57310f9d4bbfdd875e8d6/packages/revolution/src/AuctionHouse.sol#L277

Vulnerability details

Impact

The auction parameters can be changed anytime, even during ongoing auctions, and will take effect immediately. Which will be unfair and cause unexpected surprise to bidders

Proof of Concept

1. Auction is ongoing and owner changes ReservePrice() and MinBidIncrementPercentage() which will take effect immediately may cause bidders transaction to fail.
2. Bidders have certain expectations based on the initially defined auction duration. Changing TimeBuffer mid auction with setTimeBuffer() might be unfair and can lead to dissatisfaction among bidders

Tools Used

Manual Review

Recommended Mitigation Steps

Do not apply changed parameters to ongoing auctions. Changes should be applied to the next auction to avoid any unexpected behavior

Assessed type

Other