Malicious users can manipulate the bid amount placing higher bids, and cancel their bids before ending the auction

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/AuctionDemo.sol#L57
https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/AuctionDemo.sol#L124
https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/AuctionDemo.sol#L134

Vulnerability details

Impact

The existing implementation of AuctionDemo permits malicious users to manipulate the bidding process. These users strategically place counter bids for each highest bid, inflating the NFT price. They then cancel all the bids just before the auction concludes. As a consequence, other bidders are compelled to pay inflated amounts to claim the NFT.

Proof of Concept

Step 1: Malicious user places counter bids to inflate the NFT price
Malicious user participateToAuction(tokenId) with highestBidAmount + incrementAmount1 as msg.value
Malicious user participateToAuction(tokenId) with highestBidAmount + incrementAmount2 as msg.value

https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/AuctionDemo.sol#L57

Repeats when a user place a new bid.

Step 2: Malicious user cancels all the bids or the highest bid just before concluding the auction
cancelAllBids()

https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/AuctionDemo.sol#L124

https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/AuctionDemo.sol#L134

Result: Other bidders need to pay high amounts to claim the NFT due to manipulated bids.

Tools Used

Manual Review

Recommended Mitigation Steps

Prevent users from canceling their bid if they are the highest bidder. This measure compels the highest bidder or any potential malicious user to proceed with claiming the NFT rather than canceling the bid.

Assessed type

Other

[c4-pre-sort]

141345 marked the issue as duplicate of #962

[c4-judge]

alex-ppg marked the issue as not a duplicate

[c4-judge]

alex-ppg marked the issue as duplicate of #1784

[c4-judge]

alex-ppg marked the issue as duplicate of #1323

[c4-judge]

alex-ppg marked the issue as partial-25

[c4-judge]

alex-ppg marked the issue as satisfactory

[c4-judge]

alex-ppg marked the issue as partial-25