SIZE contest - corerouter's results

Lines of code

https://github.com/code-423n4/2022-11-size/blob/790811de1dffd3619d05f89a339fcac1e927117e/src/SizeSealed.sol#L157

Vulnerability details

Impact

In order to prevent DOS attack, max of 1000 bids are allowed in any auction. With the limit, it is possible the auction can be attacked in the following two ways:

1. For a red hot auction many bidders want to win, a malicious bid can work alone, or coordinate with others, to bid the auction with the price of minimumBidQuote once the auction starts. They can use 1000 different wallet address to bid with the price of minimumBidQuote and 0.1% total auction amount. After that, even someone wants to bid for the auction with higher price, he can not succeed as the max bid number of 1000 has been reached. This kind of auction is not good at price discovery and value maximization for projects.

2. If someone want to make an auction fail to raise money, he can use 1000 different wallet address to bid for the auction once the auction starts. After that, others can not bid for the auction as the max number of bid has been reached. Later on, before the auction has passed 24 hours after auction's endTimestamp, he can cancelled all the bids without any penalty, according to the current implementation. As a result, the auction has no bidders in the end and will fail to raise money.

Proof of Concept

https://github.com/code-423n4/2022-11-size/blob/790811de1dffd3619d05f89a339fcac1e927117e/src/SizeSealed.sol#L157-L159 https://github.com/code-423n4/2022-11-size/blob/790811de1dffd3619d05f89a339fcac1e927117e/src/SizeSealed.sol#L415-L430

Tools Used

Recommended Mitigation Steps

There are two ways to improve the auction mechanism:

1. Increase the max number of bids for an auction from 1,000 to a greater number such as 10,000. It will make the attack more difficult.
2. A user can only cancel a bid before some time ahead of auction endTimestamp, for example, 24 hours before an auction's end. This mechanism will make others have a chance to bid for the auction once other bidders have cancelled their bids.