SIZE contest - cryptphi's results

Lines of code

https://github.com/code-423n4/2022-11-size/blob/main/src/SizeSealed.sol#L415-L440 https://github.com/code-423n4/2022-11-size/blob/main/src/SizeSealed.sol#L238

Vulnerability details

Impact

The SizeSealed contract's cancelBid() function can be called after auction has been finalized, thereby allowing the bidder to withdraw their quoteToken after bid is finalized

This is possible by bypassing the if (a.data.lowestQuote != type(uint128).max || block.timestamp <= a.timings.endTimestamp + 24 hours) statement by allowing a.data.lowestQuote to be set to type(uint128).max during the finalize() call where clearingQuote and clearingBase are user controlled, as well as making the cancelBid and finalize call after 24 hours the auction ended.

With the control of these arguments in the clearing price calculation during finalize(), the bidder can manipulate the final data.previousQuotePerBase value by using a different address to place the last bid such that the bid's quoteAmount would pass all checks.

With all this inputs provided, it would be possible for a bidder to finalize the auction and then call cancelBid() to receive back the quoteTokens deposited for the auction.

Proof of Concept

1. Alice bids for an auction
2. Just before the end of the bid, Alice places the last bid using another address with a crafted bid quiteAmount.
3. 24 hours just after auction ends (i.e block.timestamp == a.timings.endtimeT,imestamp +24 hours), Alice calls finalize() with user supplied input for clearingQuote set to type(uint128).max and clearingBase set to an appropriate number.
4. Where no overflow reverts occur, finalize() is completed successfully with Alice receiving the calculated amount of quoteTokens for the auction.
5. Alice then calls cancelBid() right away.
6. Since the a.data.lowestQuote is set to type(uint128).max and the time is 24hrs after auction ended , the if-statement is bypassed and Alice receives back the quoteToken she deposited for the auction.

Tools Used

Manual review

Recommended Mitigation Steps

Apply a logic that checks the Auction State, the atState modifier could be applied to ensure the auction is in the AcceptingBids state for the call.