AuctionDemo.sol - Malicious winner can block other users from receiving their bid back when auction ends

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/AuctionDemo.sol#L104-L120

Vulnerability details

Impact

At the end of the auction, the winner or admin can execute claimAuction().
This function transfers NFT to the winner of the auction and iterates over auctionInfoData[_tokenid] to refund bids to other users who hadn't managed to win the auction.

This behavior poses a security risk. Malicious winner may bid from the address which does not accept NFTs. Since safeTransferFrom() will revert, claimAuction() will revert and it won't be possible for other users to get their bids back.

Proof of Concept

Whenever we bid, our address is being added to auctionInfoData[_tokenid]:

File: AuctionDemo.sol

    function participateToAuction(uint256 _tokenid) public payable {
        require(msg.value > returnHighestBid(_tokenid) && block.timestamp <= minter.getAuctionEndTime(_tokenid) && minter.getAuctionStatus(_tokenid) == true);
        auctionInfoStru memory newBid = auctionInfoStru(msg.sender, msg.value, true);
        auctionInfoData[_tokenid].push(newBid);
    }

Whenever auction ends, function claimAuction() iterates over auctionInfoData[_tokenid] and refunds bids to addresses which hadn't won the auction.

File: AuctionDemo.sol

for (uint256 i=0; i< auctionInfoData[_tokenid].length; i ++) {
            if (auctionInfoData[_tokenid][i].bidder == highestBidder && auctionInfoData[_tokenid][i].bid == highestBid && auctionInfoData[_tokenid][i].status == true) {
                IERC721(gencore).safeTransferFrom(ownerOfToken, highestBidder, _tokenid);
                (bool success, ) = payable(owner()).call{value: highestBid}("");
                emit ClaimAuction(owner(), _tokenid, success, highestBid);
            } else if (auctionInfoData[_tokenid][i].status == true) {
                (bool success, ) = payable(auctionInfoData[_tokenid][i].bidder).call{value: auctionInfoData[_tokenid][i].bid}("");
                emit Refund(auctionInfoData[_tokenid][i].bidder, _tokenid, success, highestBid);
            } else {}

If auctionInfoData[_tokenid][i].bidder == highestBidder, we transfer NFT to the winner.
However, the winner might not accept NFTs, thus safeTransferFrom() will revert.
Because of that revert, function claimAuction() will keep reverting every time we will try to call it.

This leads to a huge problem for users who bid, were outbid and didn't call cancelBid() or cancelAllBids().

Functions cancelBid() or cancelAllBids() which allow to cancel (and refund) the bid can only be called, when auction is still in progress. Since auction has ended - it's not possible to call them. The only way to get the refund is by calling claimAuction(). However, claimAuction() reverts. This means, that all bids are stuck in the contract and there's no way to get them back.

Tools Used

Manual code review

Recommended Mitigation Steps

Make sure to separate the logic of claimAuction(). Much better idea would be to have two separate functions - the first one, which will refund bids to others, and the second one - which will send NFT to the winner. That way, even when safeTransferFrom() reverts, other users will be able to get their bids refunded.

Assessed type

DoS

[c4-pre-sort]

141345 marked the issue as duplicate of #364

[c4-pre-sort]

141345 marked the issue as not a duplicate

[c4-pre-sort]

141345 marked the issue as duplicate of #1653

[c4-pre-sort]

141345 marked the issue as duplicate of #843

[c4-pre-sort]

141345 marked the issue as duplicate of #486

[c4-judge]

alex-ppg marked the issue as not a duplicate

[c4-judge]

alex-ppg marked the issue as duplicate of #1759

[c4-judge]

alex-ppg marked the issue as partial-50

[c4-judge]

alex-ppg changed the severity to 2 (Med Risk)