Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bids can be made after the auction is closed and funds are wasted. #1489

Closed
c4-submissions opened this issue Nov 13, 2023 · 5 comments
Closed

Bids can be made after the auction is closed and funds are wasted. #1489

c4-submissions opened this issue Nov 13, 2023 · 5 comments
Labels
2 (Med Risk) Assets not at direct risk, but function/availability of the protocol could be impacted or leak value bug Something isn't working duplicate-175 partial-50 Incomplete articulation of vulnerability; eligible for partial credit only (50%)

Comments

@c4-submissions
Copy link
Contributor

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/AuctionDemo.sol#L58
https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/AuctionDemo.sol#L105

Vulnerability details

Impact

Funds tendered by the user are locked into the contract and cannot be retrieved.

Proof of Concept

Looking at the conditional statements for participateToAuction and claimAuction, when block.timestamp == minter.getAuctionEndTime(_tokenid), both conditions are passed.
In other words, it would be possible to launch participateToAuction after claimAuction. claimAuction can only be launched once, so the money bid after it is over cannot be retrieved and will be wasted.

Tools Used

Manual

Recommended Mitigation Steps

Set claimAuction condition as block.timestamp > minter.getAuctionEndTime(_tokenid)

Assessed type

Timing
@c4-submissions c4-submissions added 2 (Med Risk) Assets not at direct risk, but function/availability of the protocol could be impacted or leak value bug Something isn't working labels Nov 13, 2023
c4-submissions added a commit that referenced this issue Nov 13, 2023
@c4-submissions
innertia issue #1489
abaa9e7
@c4-pre-sort
Copy link

141345 marked the issue as duplicate of #1935

@c4-pre-sort
Copy link

141345 marked the issue as duplicate of #962

@c4-judge
Copy link

c4-judge commented Dec 2, 2023

alex-ppg marked the issue as not a duplicate

@c4-judge c4-judge reopened this Dec 2, 2023
@c4-judge
Copy link

c4-judge commented Dec 2, 2023

alex-ppg marked the issue as duplicate of #1926

@c4-judge c4-judge closed this as completed Dec 2, 2023
@c4-judge c4-judge added duplicate-1926 duplicate-175 partial-50 Incomplete articulation of vulnerability; eligible for partial credit only (50%) and removed duplicate-1926 labels Dec 2, 2023
@c4-judge
Copy link

c4-judge commented Dec 8, 2023

alex-ppg marked the issue as partial-50

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
2 (Med Risk) Assets not at direct risk, but function/availability of the protocol could be impacted or leak value bug Something isn't working duplicate-175 partial-50 Incomplete articulation of vulnerability; eligible for partial credit only (50%)
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@c4-judge @c4-pre-sort @c4-submissions