AuctionDemo#claimAuction - A malicious user could steal the NFT by being the winner and canceling their bid on the last block timestamp

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/hardhat/smart-contracts/AuctionDemo.sol#L105
https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/hardhat/smart-contracts/AuctionDemo.sol#L125

Vulnerability details

Impact

The vulnerability arises due to a timing issue where block.timestamp is used as a condition to gate both the claimAuction and cancelBid functions. Specifically, when block.timestamp is equal to minter.getAuctionEndTime(_tokenId), a user can invoke both functions in the same transaction block. This is because the conditional check uses <= instead of <. Consequently, a malicious actor could claim the auctioned token with claimAuction and then invalidate their bid by calling cancelBid, retrieving their bid amount and effectively receiving the token without payment.

Proof of Concept

The attack can be executed as follows:

1. Ensure you are the highest bidder in the auction.
2. Monitor the block time closely. When block.timestamp is exactly equal to minter.getAuctionEndTime(_tokenId), execute claimAuction.
3. In the same transaction block, call cancelBid. Due to the condition block.timestamp <= minter.getAuctionEndTime(_tokenId), this will succeed.
4. Retrieve the bid amount, thus obtaining the token at no cost.

Tools Used

Manual Review.

Recommended Mitigation Steps

• Adjust the conditional checks to ensure that cancelBid cannot be called in the same block as claimAuction. This can be achieved by using a strict inequality (<) in cancelBid.
• Set auctionClaimed to true when claimAuction is successfully called. This variable should then be checked in the cancelBid function to prevent bid cancellation after a claim (require(auctionClaim[_tokenid] = false)

Assessed type

Invalid Validation

[c4-pre-sort]

141345 marked the issue as duplicate of #1904

[c4-pre-sort]

141345 marked the issue as duplicate of #962

[c4-judge]

alex-ppg marked the issue as duplicate of #1323

[c4-judge]

alex-ppg marked the issue as partial-50