NextGen - Nyx's results

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/AuctionDemo.sol#L104-L120

Vulnerability details

Impact

The auction can be DOSed by the highest bidder, trapping other bidders' funds in the contract.

Proof of Concept

Users can only call the claimAuction() function after the auction end time. Once the auction has ended, the cancelBid function becomes unavailable. If a user dont to use the cancelBid() function before the end time, they will only be able to retrieve their funds with the claimAuction() function.

If the user loses the auction, their funds will be refunded through the claimAuction() function.

else if (auctionInfoData[_tokenid][i].status == true) {
                (bool success, ) = payable(auctionInfoData[_tokenid][i].bidder).call{value: auctionInfoData[_tokenid][i].bid}(""); 
                emit Refund(auctionInfoData[_tokenid][i].bidder, _tokenid, success, highestBid);
            }

The issue is that the highest bidder can potentially cause a Denial of Service (DOS). This can happen if the winner is a contract that hasn't implemented the IERC721Receiver-onERC721Received function. As a result, the safeTransferFrom call will always revert, causing the claimAuction function to be stuck in a DOS attack indefinitely.

for (uint256 i=0; i< auctionInfoData[_tokenid].length; i ++) {
            if (auctionInfoData[_tokenid][i].bidder == highestBidder && auctionInfoData[_tokenid][i].bid == highestBid && auctionInfoData[_tokenid][i].status == true) {
                IERC721(gencore).safeTransferFrom(ownerOfToken, highestBidder, _tokenid);

Tools Used

Manual Review

Recommended Mitigation Steps

Create an admin functionality to reset auction time, enabling users to cancel bids and retrieve funds.

Assessed type

DoS

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/AuctionDemo.sol#L105 https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/AuctionDemo.sol#L58

Vulnerability details

Impact

The bidder's funds can be stuck in the contract.

Proof of Concept

The participateToAuction() function and the claimAuction can be called simultaneously when the getAuctionEndTime equals block.timestamp, which may lead to issues.

function claimAuction(uint256 _tokenid) public WinnerOrAdminRequired(_tokenid,this.claimAuction.selector){
        require(block.timestamp >= minter.getAuctionEndTime(_tokenid) && auctionClaim[_tokenid] == false && minter.getAuctionStatus(_tokenid) == true);
        auctionClaim[_tokenid] = true;

If both the claimAuction and participateToAuction functions are called at the getAuctionEndTime, funds from the caller of the participateToAuction function may become trapped in the contract.

The claimAuction function can be called by the highest bidder at the end of the auction. Another user can call the participateToAuction function to become the highest bidder at the same time.

function participateToAuction(uint256 _tokenid) public payable {
        require(msg.value > returnHighestBid(_tokenid) && block.timestamp <= minter.getAuctionEndTime(_tokenid) && minter.getAuctionStatus(_tokenid) == true);
        auctionInfoStru memory newBid = auctionInfoStru(msg.sender, msg.value, true);
        auctionInfoData[_tokenid].push(newBid);
    }

Suppose the highest bidder's transaction is included in the block before the user's transaction. In that case, the auction will end but the user's calls to participateToAuction will not revert(Because The participateToAuction is not currently checking whether the auction has already ended or not).

As a result, even if the user doesn't win the auction, they cannot retrieve their funds. The user can not call the cancelBids function because of this check.

function cancelBid(uint256 _tokenid, uint256 index) public {
        require(block.timestamp <= minter.getAuctionEndTime(_tokenid), "Auction ended");

Tools Used

Manual Review

Recommended Mitigation Steps

Don't allow the claimAuction and participateToAuction functions are not callable at the same time.

Assessed type

Other