PoolTogether V5: Part Deux - shirochan's results

Lines of code

https://github.com/GenerationSoftware/pt-v5-draw-auction/blob/f1c6d14a1772d6609de1870f8713fb79977d51c1/src/RngRelayAuction.sol#L131

Vulnerability details

Impact

There's no access restriction on rngComplete which allows anyone to execute this function and complete the auction. This can lead to unexpected behavior or potential DOS attack where a user completes the auction.

Tools Used

Manual Analysis

Recommended Mitigation Steps

It's recommended to check that only the relayer can execute this function.

/// @notice Called by the relayer to complete the Rng relay auction.
...
function rngComplete(
    uint256 _randomNumber,
    uint256 _rngCompletedAt,
    address _rewardRecipient,
    uint32 _sequenceId,
    AuctionResult calldata _rngAuctionResult
  ) external returns (bytes32) {
+    require(msg.sender == rngAuctionRelayer, "RngRelayAuction/rngComplete: Only the relayer can call this function");
    if (_sequenceHasCompleted(_sequenceId)) revert SequenceAlreadyCompleted();

Assessed type

Access Control