Bidder Can Retrieve Bid Amount Twice in claimAuction

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/AuctionDemo.sol#L116-L130

Vulnerability details

Impact

This vulnerability enables a bidder to recover their bid amount twice during the execution of the claimAuction function.

Proof of Concept

A race condition between the claimAuction and cancelBid functions allows a non-winning bidder to claim their bid twice:

• In claimAuction, the function proceeds if the auction has ended, as checked by require(block.timestamp >= minter.getAuctionEndTime(_tokenid)).
• In cancelBid, the function is accessible as long as the auction hasn't ended, verified by require(block.timestamp <= minter.getAuctionEndTime(_tokenid), "Auction ended");.
• A bidder's contract, in the line (bool success, ) = payable(auctionInfoData[_tokenid][i].bidder).call{value: auctionInfoData[_tokenid][i].bid}(""), can use its receive() function to re-enter the cancelBid function. This reentrancy can occur within the same block timestamp.
• The bidder can thus bypass the require checks in cancelBid and reclaim their bid, effectively receiving their bid amount twice.

Tools Used

manual review

Recommended Mitigation Steps

Fix timing checks in claimAuction and cancelBid

Assessed type

Reentrancy

[c4-pre-sort]

141345 marked the issue as duplicate of #2039

[c4-pre-sort]

141345 marked the issue as duplicate of #51

[c4-pre-sort]

141345 marked the issue as not a duplicate

[c4-pre-sort]

141345 marked the issue as duplicate of #962

[c4-judge]

alex-ppg marked the issue as duplicate of #1323

[c4-judge]

alex-ppg marked the issue as partial-50