SIZE contest - simon135's results

Lines of code

https://github.com/code-423n4/2022-11-size/blob/969b9591b89ab21dcc9a13925809696dcaf43938/src/SizeSealed.sol#L347

Vulnerability details

Impact

Attacker can fill up all the bids and steal and be the winner and cause a dos and then withdraw/refund the funds since when doing a refund the bid isn't taken off the array an attacker can make 1000 bids and cause dos and have 100 percent chance of winning causing a loss of funds

Proof of Concept

There is no fee taken on the amount and there can be dos and it should be removed.

        b.sender = address(0);

        emit BidRefund(auctionId, bidIndex);

        SafeTransferLib.safeTransfer(ERC20(a.params.quoteToken), msg.sender, b.quoteAmount);
    }

and no array slot popped off which can be filled causing 100 percent winnings for the bidder they are able to get all the bid amounts out and even if they don't win they cant dos the whole auction and still get their funds out with no punishment.

Tools Used

Recommended Mitigation Steps

remove the bid from an array or check the address

psudeocode
array.pop()

this if statment might not work because of the wrong check

            // Fill the remaining unfilled base amount
            if (data.filledBase + baseAmount > data.totalBaseAmount) {
                //@done  this if statement is wrong
                baseAmount = data.totalBaseAmount - data.filledBase;
            }

            b.filledBaseAmount = baseAmount;
            data.filledBase += baseAmount;
        

if baseAmount is more then totalBaseAmonut then it will revert

   // Auction has been fully filled
            if (data.filledBase == data.totalBaseAmount) continue;

https://github.com/code-423n4/2022-11-size/blob/969b9591b89ab21dcc9a13925809696dcaf43938/src/SizeSealed.sol#L289

there can be a transfer of 0 tokens and some tokens will revert

and this is possible if the base amounts are equal but then you wont get the quote amount

       // Transfer the left over baseToken
        if (data.totalBaseAmount != data.filledBase) {
 
            uint128 unsoldBase = data.totalBaseAmount - data.filledBase;

            a.params.totalBaseAmount = data.filledBase;
            SafeTransferLib.safeTransfer(
                ERC20(a.params.baseToken),
                a.data.seller,
                unsoldBase
            );
        }

edge case with vesting with e18 when the tokens vesting goes down and withdraw is more then it will revert

when you should get tokens

     baseTokensAvailable = baseTokensAvailable - b.baseWithdrawn;

        b.baseWithdrawn += baseTokensAvailable;

just of time the loop will get to this

bta=BaseTokenAmount
bw=basewithdraw

        /*
        bta=1e18
        bw=1e18
        bta=1e14
        bw=1e22
        bta=1e10
        bta-bw//revert 



        */

as the tokens decrease the bw will get bigger causing a revert