NextGen - blutorque's results

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/AuctionDemo.sol#L104-L120

Vulnerability details

Impact

AuctionDemo::claimAuction() allows the claiming the token with highest bid. The Winner or admin both can call the function once the auction ends or the block.timestamp >= to auction end time. The issue is claim and cancel function can be call at exactly at the same timestamp, which is auctionEndTime.

A malicious bidder can bid as highest to be winner, and then perform claim call followed by bidder(as malicious contract) fallback trigger followed by cancelBid() on the auction contract, all at the same timestamp the auction end.

And because the we are not checking success value for other bidders fund transfer, it allows the attacker to steal their funds without reverting.

https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/AuctionDemo.sol#L116

Proof of Concept

1. Alice saw the auction, wait for the last seconds before auction ends.
2. Alice frontrun any participateToAuction call, with highest possible amount(not greater than other bidder combine bid amount).
3. Alice became highest bidder, and when block.timestamp == minter.getAuctionEndTime(_tokenid) reached, alice as malicious bidder perform call to claimAuction() -> malicious bidder contract -> cancelBid().

Alice manage to claim the highest amount she bid, also stealing others bid amount.

Tools Used

Manual review

Recommended Mitigation Steps

Use reentrancy guard to avoid reentrancy, cancelBid() and participateToAuction() should only be called for the timestamp < minter.getAuctionEndTime(_tokenId).

Assessed type

Reentrancy