A user can win the auction even with a very small bid #1797
Labels
3 (High Risk)
Assets can be stolen/lost/compromised directly
bug
Something isn't working
duplicate-1323
partial-25
Incomplete articulation of vulnerability; eligible for partial credit only (25%)
Comments
c4-submissions
added
3 (High Risk)
|
141345 marked the issue as duplicate of #962 |
|
alex-ppg marked the issue as not a duplicate |
|
alex-ppg marked the issue as duplicate of #1784 |
|
alex-ppg marked the issue as duplicate of #1323 |
c4-judge
added
the
partial-25
|
alex-ppg marked the issue as partial-25 |
c4-judge
added
satisfactory
|
alex-ppg marked the issue as satisfactory |
c4-judge
added
partial-25
|
alex-ppg marked the issue as partial-25 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Lines of code
https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/AuctionDemo.sol#L124-L143
Vulnerability details
Impact
A user can win the auction with a very small bid even if there are other users who would like to buy the NFT with a higher price.
Proof of Concept
The
cancelBidandcancelAllBidsfunctions do not contain a prohibition on canceling the best bet.https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/AuctionDemo.sol#L124-L143
Therefore, a malicious user can make a minimum bid at the beginning of the auction and then make an unreasonably high bid. During the auction, other users will no longer be able to place normal bids. Just before the end of the auction, the user cancels his high bid. Thus, the winning bid is the user's first bid.
Tools Used
Manual review
Recommended Mitigation Steps
Сonsider not canceling a current best bid.
Assessed type
Other
The text was updated successfully, but these errors were encountered: