Malicious winner can hold an auction hostage

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/AuctionDemo.sol#L104-L120

Vulnerability details

Impact

A contract that wins an auction can postpone owner & refundee’s payments indefinitely.

Proof of Concept

At the time of winning, an Auction holds the owner’s sell fee (equal to what the winning bid is) and also holds extra funds from the non-winning bids. Upon concluding an auction it is expected that the owner & refundees receive their payments. To distribute these fees either an Admin or the winner of the auction has to call claimAuction(...). The issue is that a malicious actor can bid & win through a contract that has a reverting onERC721Received() hook function. In that case claimAuction(...) will revert when it attempts to safeTransferFrom(...) the NFT to the malicious bidder. In such a manner a malicious winner can have final authority when and if the owner & refundees get their payments. Note that this does require financial commitment from the malicious winner (i.e he has to win the auction), however the funds that will be withheld will be more than what he commits.

Additional Note

The same idea of bricking an auction’s funds and NFT but at significantly cheaper cost (eg 1 wei + gas fees) can be executed by a malicious bidder that front runs the first bid through a contract that implements a “return bomb” (memory expansion & copy attack) in the fallback() function - this will cause claimAuction(...) to revert when it attempts to refund the 1 wei bidder. This finding however will most likely be deemed OOS because of [L-18] in the bot findigs, nevertheless, I am noting it here for sponsor’s & judge reference since it implies severe consequneces.

Coded POC

• Run forge init --force
• Place the code from the gist in a test file under /test
• POC Gist - https://gist.github.com/alexxander77/0cca44dea3d670e08bd72aaf4d905d35
• run with forge test --match-test testForcedRevert
• Output - claimAuction(...) reverts

Tools Used

Manual Inspection

Recommended Mitigation Steps

Separate the logic of claiming the NFT, paying the owner & refunding refundees.

Assessed type

DoS

[c4-pre-sort]

141345 marked the issue as duplicate of #1952

[c4-judge]

alex-ppg marked the issue as not a duplicate

[c4-judge]

alex-ppg marked the issue as duplicate of #1759

[c4-judge]

alex-ppg marked the issue as partial-50