SIZE contest - jayphbee's results

Lines of code

https://github.com/code-423n4/2022-11-size/blob/main/src/SizeSealed.sol#L163 https://github.com/code-423n4/2022-11-size/blob/main/src/SizeSealed.sol#L327 https://github.com/code-423n4/2022-11-size/blob/main/src/SizeSealed.sol#L351 https://github.com/code-423n4/2022-11-size/blob/main/src/SizeSealed.sol#L381 https://github.com/code-423n4/2022-11-size/blob/main/src/SizeSealed.sol#L381

Vulnerability details

Impact

bidder can get baseToken for free if auction creator specify an qutoeToken address without code.

Proof of Concept

The solmate SafeTransferLib leaves the code existence checking responsibility for user. In the createAuction method, the baseToken code existence is implicitly checked by calling the balanceOf function on it. If the baseToken address have no code, this call will revert.

        // Passes https://github.com/transmissions11/solmate/blob/main/src/utils/SafeTransferLib.sol#L9
        // Transfer base tokens to auction contract and check for tax tokens
        uint256 balanceBeforeTransfer = ERC20(auctionParams.baseToken).balanceOf(address(this));

However it doesn't check the auctionParams's quoteToken code existence, if the auction creator specify an address without code, the SafeTransferLib.safeTransfer and SafeTransferLib.transferFrom will return successfully without revert. In the bid function the bidder will transfer said amount of quoteToken to SizeSealed contract, but the contract receive nothing actually. https://github.com/code-423n4/2022-11-size/blob/main/src/SizeSealed.sol#L163

SafeTransferLib.safeTransferFrom(ERC20(a.params.quoteToken), msg.sender, address(this), quoteAmount);

In the finalize period, the qutoToken will trasnsfer to the seller by calling https://github.com/code-423n4/2022-11-size/blob/main/src/SizeSealed.sol#L327

SafeTransferLib.safeTransfer(ERC20(a.params.quoteToken), a.data.seller, filledQuote);

The seller receives nothing in the same way. That is to say, the bidder will get the baseToken for free.

Tools Used

manual review

Recommended Mitigation Steps

check the code exsitence for quoteToken in the createAuction function.

        .......
        if (
            FixedPointMathLib.mulDivDown(
                auctionParams.minimumBidQuote, type(uint128).max, auctionParams.totalBaseAmount
            ) > auctionParams.reserveQuotePerBase
        ) {
            revert InvalidReserve();
        }

        if (auctionParams.quoteToken.code.length == 0) {
            revert InvalidQuoteToken();
        }

        uint256 auctionId = ++currentAuctionId;
      ......