SIZE contest - Ruhum's results

Lines of code

https://github.com/code-423n4/2022-11-size/blob/main/src/SizeSealed.sol#L163

Vulnerability details

Impact

For the base token, there's an explicit check to handle fee-on-transfer tokens. But, that's not done for the quote token. If such a token is used for an auction, the transaction of the last people to withdraw will fail. Their tokens will be locked up in the contract.

Proof of Concept

The bid() function just transfers quoteAmount from the caller to the contract. It doesn't verify that it received the exact amount: https://github.com/code-423n4/2022-11-size/blob/main/src/SizeSealed.sol#L163

After the auction finishes and people start withdrawing their funds, the contract will reach a state where a user will have a higher quote token balance than the contract owns. Depending on who the last caller is, bid winner or looser, you get the following two scenarios:

• Bid winner won't be able to withdraw their base tokens and quote tokens. Quote tokens are distributed when withdrawing the base tokens which will fail: https://github.com/code-423n4/2022-11-size/blob/main/src/SizeSealed.sol#L381
• Bid looser won't be able to get a refund on the quote tokens they used to bid: https://github.com/code-423n4/2022-11-size/blob/main/src/SizeSealed.sol#L351

Because the amount transferred when calling these functions is not user-controlled, there's no way to unlock part of the tokens. The only solution is for someone to send quote tokens to the contract so that the contract has enough tokens to cover the user's withdrawal.

Tools Used

none

Recommended Mitigation Steps

Add the fee-on-transfer check to the bid() function as well.