Revolution Protocol - PNS's results

Lines of code

https://github.com/code-423n4/2023-12-revolutionprotocol/blob/d42cc62b873a1b2b44f57310f9d4bbfdd875e8d6/packages/revolution/src/AuctionHouse.sol#L217 https://github.com/code-423n4/2023-12-revolutionprotocol/blob/d42cc62b873a1b2b44f57310f9d4bbfdd875e8d6/packages/revolution/src/AuctionHouse.sol#L253 https://github.com/code-423n4/2023-12-revolutionprotocol/blob/d42cc62b873a1b2b44f57310f9d4bbfdd875e8d6/packages/revolution/src/AuctionHouse.sol#L297

Vulnerability details

Impact

When an auction starts, it has established rules that all participants (creators, bidders, owner) agree to. However, the owner of the auction may change it immediately without informing the people involved, including the person with the highest bid. The bid cannot be withdrawn, so the division of auction profits will take place according to new rules to which the bidder did not agree. This is a breach of the contract agreed to by all participants when they entered the auction. This creates a lack of trust in the system and at the same time may deprive the creator of his earnings.

The auction conditions should remain unchanged throughout the duration of the auction.

Proof of Concept

When the auction starts, only startTime and endTime are saved in its parameters, the rest of the parameters responsible for the division of profits are calculated dynamically when it ends.

File: AuctionHouse.sol
317:             auction = Auction({
318:                 verbId: verbId,
319:                 amount: 0,
320:                 startTime: startTime,
321:                 endTime: endTime,
322:                 bidder: payable(0),
323:                 settled: false
324:             });

How profits from the auction are distributed is determined by the parameters creatorRateBps, minCreatorRateBps, entropyRateBps. While the value of creatorRateBps cannot be less than minCreatorRateBps and minCreatorRateBps cannot be decreased, there are no conditions for changing entropyRateBps, which may deprive the creator of direct profits in ETH.

Tools Used

manual review

Recommended Mitigation Steps

The structure containing auction data should be expanded with additional parameters containing profit sharing settings. In this way, there will be a permanent record that the auction participants agree to at the beginning and which will remain unchanged throughout the duration of the auction. Changes introduced by the owner will be effective from the next auction. If a change in parameters is required, it can be done by canceling the ongoing auction, refunding the funds and starting a new auction.

Assessed type

Governance