Should not enable claiming at auction end time

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/AuctionDemo.sol#L124
https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/AuctionDemo.sol#L104

Vulnerability details

Impact

Should not enable claiming at auction end time, or the winner can claim token without pay the ETH.

Proof of Concept

There are 2 phases in an entire auction, the bidding phase and claiming phase.

In bidding phase, bidders place bids if they want to participate, or cancel bids if they want to leave;
In claiming phase, winner claiming the token and the ETH will be returned to other bidders.

Unfortunately, if we look carefully at cancelBid and claimAuction, we can find that there is time overlap between the 2 phases:

        // bidding phase
        require(block.timestamp <= minter.getAuctionEndTime(_tokenid), "Auction ended");

        // claiming phase
        require(block.timestamp >= minter.getAuctionEndTime(_tokenid) && auctionClaim[_tokenid] == false && minter.getAuctionStatus(_tokenid) == true);

Both claiming and canceling can be done at auctionEndTime, this means the winner may first claim the token and then cancel the winning bid to get ETH back at the time point.

Tools Used

Manual Review

Recommended Mitigation Steps

To mitigate this issue, please remove the time overlap and only allow claiming after auctionEndTime.

Assessed type

ERC721

[c4-pre-sort]

141345 marked the issue as duplicate of #962

[c4-judge]

alex-ppg marked the issue as not a duplicate

[c4-judge]

alex-ppg marked the issue as duplicate of #1788

[c4-judge]

alex-ppg marked the issue as partial-50

[c4-judge]

alex-ppg marked the issue as partial-25