Auction winner can claim token and cancel bid at the same time

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/AuctionDemo.sol#L105

Vulnerability details

Impact

Auction winner can claim token and cancel bid at the AuctionEndTime, user gets a free token and protocol suffers a loss.

Proof of Concept

User can claim token at the end of an auction:

        require(block.timestamp >= minter.getAuctionEndTime(_tokenid) && auctionClaim[_tokenid] == false && minter.getAuctionStatus(_tokenid) == true);

And user can also cancel bid at the end of an auction:

        require(block.timestamp <= minter.getAuctionEndTime(_tokenid), "Auction ended");

So if block.timestamp is equal to AuctionEndTime, a winner can claim token and then cancel his bid at the same time. Winner gets a free token and protocol suffers a loss.

Tools Used

Manual Review

Recommended Mitigation Steps

Token should only be claimed after auction ends.

-       require(block.timestamp >= minter.getAuctionEndTime(_tokenid) && auctionClaim[_tokenid] == false && minter.getAuctionStatus(_tokenid) == true);
+       require(block.timestamp > minter.getAuctionEndTime(_tokenid) && auctionClaim[_tokenid] == false && minter.getAuctionStatus(_tokenid) == true);

Assessed type

Access Control

[c4-pre-sort]

141345 marked the issue as duplicate of #962

[c4-judge]

alex-ppg marked the issue as not a duplicate

[c4-judge]

alex-ppg marked the issue as duplicate of #1788

[c4-judge]

alex-ppg marked the issue as partial-25