Malicious user can perform a permanent DoS to the AuctionDemo::claimAuction function by consuming all transaction gas

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/hardhat/smart-contracts/AuctionDemo.sol#L116

Vulnerability details

Impact

The AuctionDemo::claimAuction will become permanently bricked, which means that all non-winning bids that were placed while the auction was active will not be able to be refunded, the Ether from the winning bid will not be able to be sent to the contract owner, and the auction winner will not be able to receive his NFT.

Proof of Concept

Let's take the following example:

1. A new auction starts
2. Just after it starts, a malicious user places a dust amount bid on it, through a contract that loops endlessly in its receive function
3. After that, the auction goes on as normal, users place bids back and forth and everything seems to be fine
4. The auction comes to an end
5. The auction winner proceeds to call the AuctionDemo::claimAuction function in order to claim the NFT that they just won.
6. Unfortunately for him though, the function reverts, since the block gas limit was reached, due to the endless loop inside the receive function of the malicious bidder contract. And the function will keep on reverting, no matter how many times it gets called.

Please note: In this example, the malicious bidder is the first one to place a bid, but this is not strictly necessary. The malicious bid can be placed at any time during the auction, as long as it is not the winning bid (since the Ether from that one gets sent to the contract owner instead of being refunded). The provided example is just the worst-case scenario, where the attacker performs the exploit in the cheapest way possible.

Tools Used

Manual Review

Recommended Mitigation Steps

Add a gas cap to the refund call.

Assessed type

DoS

[c4-pre-sort]

141345 marked the issue as duplicate of #486

[c4-judge]

alex-ppg marked the issue as not a duplicate

[c4-judge]

alex-ppg marked the issue as duplicate of #1782

[c4-judge]

alex-ppg marked the issue as partial-50