NextGen - kimchi's results

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/main/smart-contracts/AuctionDemo.sol#L57-L61 https://github.com/code-423n4/2023-10-nextgen/blob/main/smart-contracts/AuctionDemo.sol#L65-L83 https://github.com/code-423n4/2023-10-nextgen/blob/main/smart-contracts/AuctionDemo.sol#L124-L130

Vulnerability details

Impact

Improper functioning of the auction which allows you to buy at a low price and block other users from participating. Auctions should generally encourage users to bid up the price within a certain period of time in order to obtain the highest possible amount for the seller. However, the current architecture of the AuctionDemo allows for its abuse and inappropriate behavior, which strongly favors people with large amounts of money. They can prevent other users from participating and ultimately buy the auction item for a minimum price.

Proof of Concept

1. After the auction starts, the attacker places a very high bid (significantly exceeding the token value) using the participateToAuction function.
2. Other users do not bid because placing bids requires raising them due to the L58 lines

require(msg.value > returnHighestBid(_tokenid) && block.timestamp <= minter.getAuctionEndTime(_tokenid) && minter.getAuctionStatus(_tokenid) == true);

3. Just before the end of the auction, the attacker cancels his very high bid with cancelBid and immediately submits a new one (this time with a very low value), winning the auction in an unfair way.

In this way, the amount achieved due to the auction will be much lower, and potential buyers will lose the opportunity to participate in it.

Tools Used

Manual review

Recommended Mitigation Steps

Allow bid cancellations only for a specified period of time, which must be significantly shorter than the auction duration.

Assessed type

Other