DoS in ‘ claimAuction() ’ function if an address maliciously reverts while receiving refund.

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/main/smart-contracts/AuctionDemo.sol#L104-L120

Vulnerability details

Impact

A malicious address can place a trivial bid and perform a DoS attack by reverting while receiving the refund.

Proof of Concept

Adam = Attacker

Adam places a trivial bid of 69 wei at the start of the auction from a contract that is designed to
revert when receiving ether.

receive() external payable {
        
        revert("Reverting: I'm malicious ");
}

When the auction eventually ends and the claimAuction() function is called by either the winner or Admin,
The refunds and NFT transfer dont happen as expected.

Because Adam's contract reverts upon receiving the refund
thus creating a Denial of Service for all bidders involved.

This can be averted by preferring 'pull over push' pattern for withdrawals / refunds.

Tools Used

Manual Review, Foundry.

Recommended Mitigation Steps

Enforce 'pull over push' design pattern for withdrawals / refunds,
as it is more secure and flexible.
It allows users or external contracts to withdraw funds on their own initiative.
This way a DoS attack could be prevented.

Assessed type

DoS

[c4-pre-sort]

141345 marked the issue as duplicate of #1632

[c4-pre-sort]

141345 marked the issue as duplicate of #843

[c4-pre-sort]

141345 marked the issue as duplicate of #486

[c4-judge]

alex-ppg marked the issue as not a duplicate

[c4-judge]

alex-ppg marked the issue as duplicate of #2006

[c4-judge]

alex-ppg marked the issue as unsatisfactory:
Out of scope

[c4-judge]

alex-ppg marked the issue as unsatisfactory:
Out of scope