Calls inside a loop might lead to a denial-of-service attack.

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/AuctionDemo.sol#L112
https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/AuctionDemo.sol#L139
https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/AuctionDemo.sol#L113
https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/AuctionDemo.sol#L116

Vulnerability details

Impact

A call inside a loop is a situation where a function iterates over a collection of elements, and makes an external call to another contract for each element. An external call is a low-level interface that allows a contract to interact with another contract, such as call, delegatecall, staticcall, or transfer.

Proof of Concept

The issue with calls inside a loop is that they can lead to a denial-of-service attack, which is a type of attack that aims to make a contract unresponsive, unavailable, or fail to execute its logic. This can happen for several reasons.
Source of code:- https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/AuctionDemo.sol#L112
'''
IERC721(gencore).safeTransferFrom(ownerOfToken, highestBidder, _tokenid);
'''
Source of code:- https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/AuctionDemo.sol#L113
'''
(bool success, ) = payable(owner()).call{value: highestBid}("");
'''

Source of code:- https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/AuctionDemo.sol#L116
'''
(bool success, ) = payable(auctionInfoData[_tokenid][i].bidder).call{value: auctionInfoData[_tokenid][i].bid}("");
'''

Source of code:- https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/AuctionDemo.sol#L139
'''
(bool success, ) = payable(auctionInfoData[_tokenid][i].bidder).call{value: auctionInfoData[_tokenid][i].bid}("");
'''

Tools Used

Manual

Recommended Mitigation Steps

favoring the pull over push strategy for external calls, which is a best practice to prevent denial-of-service attacks. The pull over push strategy consists of two steps:

• Push: Instead of making the external calls immediately, store the information about the calls in a mapping or an array, and emit an event to notify the recipients.
• Pull: Instead of pushing the funds or the data to the recipients, let them pull it from the contract by calling a withdraw function.

Assessed type

call/delegatecall

[c4-pre-sort]

141345 marked the issue as duplicate of #486

[c4-judge]

alex-ppg marked the issue as not a duplicate

[c4-judge]

alex-ppg marked the issue as duplicate of #2006

[c4-judge]

alex-ppg marked the issue as unsatisfactory:
Out of scope

[c4-judge]

alex-ppg marked the issue as unsatisfactory:
Out of scope