If the safeTransferFrom call inside the AuctionDemo::claimAuction function reverts for any reason, all funds will be stuck within the contract, possibly forever

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/hardhat/smart-contracts/AuctionDemo.sol#L112

Vulnerability details

Impact

All non-winning user bids won't be able to be refunded and the contract owner won't be able to receive the ETH from the winning bid

Proof of Concept

The safeTransferFrom call that is being made in the AuctionDemo::claimAuction function, in order to send the auction winner their NFT, can revert, both intentionally and unintentionally. For example, it can revert if the receiver address does not implement the IERC721Receiver interface, or it can also revert if the onERC721Received function that is called within safeTransferFrom reverts. If some of those scenarios take place, the claimAuction function will be DoSed, possibly forever, depending on the root cause of the revert.

To help visualise the problem further, let's take a step-by-step example of how it can occur unintentionally:

1. A new auction starts
2. Users start placing bids back and forth
3. The auction comes to an end
4. The auction winner calls the claimAuction function in order to claim the NFT that they just won
5. Unfortunately for all auction participants though though, since the winner does not implement the IERC721Receiver interface, his transaction gets reverted. And it will keep on reverting no matter what the he does and how many times the function gets called. All of the auction funds are now stuck within the contract forever.

Tools Used

Manual Review

Recommended Mitigation Steps

Extract the safeTransferFrom call into a separate function.

Assessed type

DoS

[c4-pre-sort]

141345 marked the issue as duplicate of #486

[c4-pre-sort]

141345 marked the issue as high quality report

[c4-pre-sort]

141345 marked the issue as remove high or low quality report

[c4-judge]

alex-ppg marked the issue as not a duplicate

[c4-judge]

alex-ppg marked the issue as duplicate of #1759

[c4-judge]

alex-ppg marked the issue as partial-50