NextGen - Silvermist's results

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/AuctionDemo.sol#L134-L143 https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/AuctionDemo.sol#L135

Vulnerability details

Impact

The logic behind the claimAuction is that higgestBidder receives the NFT and its bid is transferred to the owner of the NFT. The other participants in the auction get back their money back.

There is a function cancelBid which allows users to cancel thеir bid before the auction's end and get their money back. The problem here occures because of the check in the cancelBid require(block.timestamp <= minter.getAuctionEndTime(_tokenid), "Auction ended");. It allows users to cancel their bid before the end of the auction or exactly when the auction ends.

If claimAuction and cancelBid are executed in the same block on block.timestamp == minter.getAuctionEndTime(_tokenid), the winner can get the NFT for free or a bidders can return its bid even though it has already been returned.

Proof of Concept

A possible scenario:

1. Bob sends the higgest bid, so he can become the winner.
2. The winner(which will be Bob) calls claimAuction as soon as the auction ends so block.timestamp == minter.getAuctionEndTime(_tokenid) and gets the NFT.
3. Immediatelly after that, Bob calls cancelBid and because of the require that allows the function to be called on the auction end timestamp, he can get his money.
4. Bob ends with the NFT and as he was able to call the cancelBid and return his money, the NFT is free for him.

Another possible scenario: Although all bidder's money (except the winner's) are returned in this else if. A bidder can call cancelBid on block.timestamp == minter.getAuctionEndTime(_tokenid) and retrieve its bid even though it has already been returned.

Tools Used

Manual Review

Recommended Mitigation Steps

cancelBid and cancelAllBids should allow bidder to cancel its bid only before auction end

    function cancelBid(uint256 _tokenid, uint256 index) public {
-       require(block.timestamp <= minter.getAuctionEndTime(_tokenid), "Auction ended");
+       require(block.timestamp < minter.getAuctionEndTime(_tokenid), "Auction ended");
        require(auctionInfoData[_tokenid][index].bidder == msg.sender && auctionInfoData[_tokenid][index].status == true);
        auctionInfoData[_tokenid][index].status = false;
        (bool success, ) = payable(auctionInfoData[_tokenid][index].bidder).call{value: auctionInfoData[_tokenid][index].bid}("");
        emit CancelBid(msg.sender, _tokenid, index, success, auctionInfoData[_tokenid][index].bid);
    }

Assessed type

Other