If the contract of the malicious ownerOfToken refuses to receive payment, the assets of the highest bidder will be frozen.

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/main/smart-contracts/AuctionDemo.sol#L113-L117

Vulnerability details

Impact

If ownerOfToken is a malicious contract, this will cause the return value of the call to be false, and the return value is not checked. The following code will continue to execute. The user with the highest bid will never be able to claim Auction, but the funds of other users will be returned.

Proof of Concept

Suppose A is an address (contract address) that was minted. At this time, ownerOfToken is a malicious address. As long as a revert code is written in the contract to refuse payment, if this NFT is auctioned, the payment with the highest price will be rejected, but other users' All bids will be returned. Even the administrator cannot solve this problem because the malicious contract will always revert.

The address of the malicious token owner
contract Attack {
    //.........other functions

    receive() external payable {
        revert();
    }
}

Tools Used

Manual review

Recommended Mitigation Steps

Checks the return value of the call. If it false(i.e., a malicious contract is detected: the holder of the malicious NFT), the next step of code execution is not performed.
The purpose of this is to prevent the user with the highest bid from continuing to execute the code logic below for refunds for other users after their payment is rejected by the malicious contract.

require(success, "Transfer failed");

It is also necessary to completely delete the NFT of this malicious contract.
Code reference:👇
https://github.com/code-423n4/2023-10-nextgen/blob/main/smart-contracts/ERC721Enumerable.sol#L116

Assessed type

DoS

[c4-pre-sort]

141345 marked the issue as duplicate of #843

[c4-pre-sort]

141345 marked the issue as duplicate of #486

[c4-judge]

alex-ppg marked the issue as not a duplicate

[alex-ppg]

The Warden specifies that a malicious owner of the token can revert when they receive native funds which is inconsequential as the native transfer is unchecked in the referenced code block.

[c4-judge]

alex-ppg marked the issue as unsatisfactory:
Invalid