Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Missing extensions in the auction mechanism: the attacker can win auctions by paying a negligible amount. #655

Closed
c4-submissions opened this issue Nov 9, 2023 · 7 comments
Closed

Missing extensions in the auction mechanism: the attacker can win auctions by paying a negligible amount. #655

c4-submissions opened this issue Nov 9, 2023 · 7 comments
Labels
3 (High Risk) Assets can be stolen/lost/compromised directly bug Something isn't working duplicate-1323 partial-25 Incomplete articulation of vulnerability; eligible for partial credit only (25%)

Comments

@c4-submissions
Copy link
Contributor

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/AuctionDemo.sol#L18

Vulnerability details

Impact

The attacker can win auctions by paying a negligible amount.

Proof of Concept

Quote from Opensea

Any bids made in the last 10 minutes of an auction will extend each auction by 10 more minutes. Popular auctions are often extended by new bids offered in the last 10 minutes.

However, bids placed in the last minutes will not receive an extension in this system, which can lead to exploitation.

Attack Flow:

  1. Front run the first bid and place a really high bid to prevent any one from participating.
  2. When the auction end time is readched, cancel the current bid and submit a lower bid(msg.value == 1 wei) to win the auction.

Tools Used

VS Code

Recommended Mitigation Steps

Add an extension if a bid is placed in the last 10 minutes.

Assessed type

Timing
@c4-submissions c4-submissions added 3 (High Risk) Assets can be stolen/lost/compromised directly bug Something isn't working labels Nov 9, 2023
c4-submissions added a commit that referenced this issue Nov 9, 2023
@c4-submissions
Soul22 issue #655
8f46bf0
@c4-pre-sort
Copy link

141345 marked the issue as duplicate of #962

@c4-judge c4-judge reopened this Dec 2, 2023
@c4-judge
Copy link

c4-judge commented Dec 2, 2023

alex-ppg marked the issue as not a duplicate

@c4-judge c4-judge closed this as completed Dec 2, 2023
@c4-judge
Copy link

c4-judge commented Dec 2, 2023

alex-ppg marked the issue as duplicate of #1784

@alex-ppg alex-ppg mentioned this issue Dec 7, 2023
Closed
@c4-judge
Copy link

c4-judge commented Dec 7, 2023

alex-ppg marked the issue as duplicate of #1323

@c4-judge
Copy link

c4-judge commented Dec 8, 2023

alex-ppg marked the issue as partial-25

@c4-judge c4-judge added the partial-25 Incomplete articulation of vulnerability; eligible for partial credit only (25%) label Dec 8, 2023
@c4-judge
Copy link

c4-judge commented Dec 8, 2023

alex-ppg marked the issue as satisfactory

@c4-judge c4-judge added satisfactory satisfies C4 submission criteria; eligible for awards partial-25 Incomplete articulation of vulnerability; eligible for partial credit only (25%) and removed partial-25 Incomplete articulation of vulnerability; eligible for partial credit only (25%) satisfactory satisfies C4 submission criteria; eligible for awards labels Dec 8, 2023
@c4-judge
Copy link

c4-judge commented Dec 8, 2023

alex-ppg marked the issue as partial-25

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
3 (High Risk) Assets can be stolen/lost/compromised directly bug Something isn't working duplicate-1323 partial-25 Incomplete articulation of vulnerability; eligible for partial credit only (25%)
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@c4-judge @c4-pre-sort @c4-submissions