Revolution Protocol - twcctop's results

Lines of code

https://github.com/code-423n4/2023-12-revolutionprotocol/blob/08ff070da420e95d7c7ddf9d068cbf54433101c4/packages/revolution/src/ERC20TokenEmitter.sol#L152-L230

Vulnerability details

Impact

Possible token gets stuck when buyToken, buyToken tokens are not fully sent

Proof of Concept

In buytoken, there are two send token logic

       (bool success, ) = treasury.call{ value: toPayTreasury }(new bytes(0));
        require(success, "Transfer failed.");

        //Transfer ETH to creators
        if (creatorDirectPayment > 0) {
            (success, ) = creatorsAddress.call{ value: creatorDirectPayment }(new bytes(0));
            require(success, "Transfer failed.");
        }

And there is no other send token logic, the issue is toPayTreasury and creatorDirectPayment is possible not equal the total msgValueRemaining .

According to the logic

 int totalTokensForCreators = ((msgValueRemaining - toPayTreasury) - creatorDirectPayment) > 0
            ? getTokenQuoteForEther((msgValueRemaining - toPayTreasury) - creatorDirectPayment)
            : int(0);

((msgValueRemaining - toPayTreasury) - creatorDirectPayment) is possible to >0 , this part of token is possible to get stuck in contract.

Tools Used

manual

Recommended Mitigation Steps

this part of token should send to creator or treasury

Assessed type

Context

Lines of code

https://github.com/code-423n4/2023-12-revolutionprotocol/blob/08ff070da420e95d7c7ddf9d068cbf54433101c4/packages/revolution/src/AuctionHouse.sol#L336-L361 https://github.com/code-423n4/2023-12-revolutionprotocol/blob/08ff070da420e95d7c7ddf9d068cbf54433101c4/packages/revolution/src/AuctionHouse.sol#L287-L291

Vulnerability details

Impact

setReservePrice may affect the settleAuction logic

Proof of Concept

   function _settleAuction() internal {
        ...
        if (address(this).balance < reservePrice) {
        ...
            // And then burn the Noun
            verbs.burn(_auction.verbId);

In function _settleAuction , if the balance of the contract is less than reservePrice, the verb nft will burn and not send to the bidder. Let's take a look when will situation happen, in createBid, there do have reservePrice check,
the situation address(this).balance < reservePrice in _settleAuction happens only when the admin role change reservePrice during a auction.

  function setReservePrice(uint256 _reservePrice) external override onlyOwner {
        reservePrice = _reservePrice;

        emit AuctionReservePriceUpdated(_reservePrice);
    }

So the issue is, during a auction, one user have the highest bid but due to the change of reservePrice , this user can not get the nft.

Tools Used

manual

Recommended Mitigation Steps

should transfer nft to the bidder

Assessed type

Context