Ether from highest bid in AuctionDemo contract is not transferred to the owner of the token

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/08a56bacd286ee52433670f3bb73a0e4a4525dd4/smart-contracts/AuctionDemo.sol#L113

Vulnerability details

Impact

The owner of a token being auctioned in the DemoContract will receive 0 ether at the end of the auction in exchange for the token.

Proof of Concept

The ether from the highest bidder is transferred to the owner() of the AuctionDemo contract, not to the owner of the token being auctioned, as it can be seen in these lines

Recommended Mitigation Steps

Change owner() for ownerOfToken when sending the ether from highest bid:

@@ -110,8 +110,8 @@ contract auctionDemo is Ownable {
         for (uint256 i=0; i< auctionInfoData[_tokenid].length; i ++) {
             if (auctionInfoData[_tokenid][i].bidder == highestBidder && auctionInfoData[_tokenid][i].bid == highestBid && auctionInfoData[_tokenid][i].status == true) {
                 IERC721(gencore).safeTransferFrom(ownerOfToken, highestBidder, _tokenid);
-                (bool success, ) = payable(owner()).call{value: highestBid}("");
-                emit ClaimAuction(owner(), _tokenid, success, highestBid);
+                (bool success, ) = payable(ownerOfToken).call{value: highestBid}("");
+                emit ClaimAuction(ownerOfToken, _tokenid, success, highestBid);
             } else if (auctionInfoData[_tokenid][i].status == true) {
                 (bool success, ) = payable(auctionInfoData[_tokenid][i].bidder).call{value: auctionInfoData[_tokenid][i].bid}("");
                 emit Refund(auctionInfoData[_tokenid][i].bidder, _tokenid, success, highestBid);

Assessed type

ETH-Transfer

[c4-pre-sort]

141345 marked the issue as duplicate of #245

[c4-judge]

alex-ppg marked the issue as satisfactory

[c4-judge]

alex-ppg changed the severity to 2 (Med Risk)