Incorrect Ether Transfer to Token Owner

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/main/smart-contracts/AuctionDemo.sol#L113

Vulnerability details

Impact

The smart contract in question contains a critical issue related to the transfer of Ether during the auction claiming process.
When a user claims their auction winnings, Ether is meant to be transferred to the owner of the token being auctioned.
However, the current implementation mistakenly transfers Ether to the contract's owner instead.
This error can have significant consequences as it results in the incorrect distribution of funds, potentially causing financial losses for the users involved in the auction.
Additionally, it could lead to unexpected behavior and disputes regarding the ownership of tokens and funds.

Proof of Concept

function claimAuction(uint256 _tokenid) public WinnerOrAdminRequired(_tokenid,this.claimAuction.selector){
   ..
    for (uint256 i=0; i< auctionInfoData[_tokenid].length; i ++) {
        if (auctionInfoData[_tokenid][i].bidder == highestBidder && auctionInfoData[_tokenid][i].bid == highestBid && auctionInfoData[_tokenid][i].status == true) {
            IERC721(gencore).safeTransferFrom(ownerOfToken, highestBidder, _tokenid);
            (bool success, ) = payable(owner()).call{value: highestBid}(""); // should be ownerOfToken
            emit ClaimAuction(owner(), _tokenid, success, highestBid);
        }..
}

Tools Used

manual review

Recommended Mitigation Steps

To address this issue, it is crucial to modify the Ether transfer mechanism in the contract's claim auction function. Specifically, replace owner() with the variable ownerOfToken in the payable call:

(bool success, ) = payable(ownerOfToken).call{value: highestBid}("");

Assessed type

Context

[c4-pre-sort]

141345 marked the issue as duplicate of #245

[c4-judge]

alex-ppg marked the issue as satisfactory