Bidders have no way to withdraw their bids if the auctioned NFT is not claimed.

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/main/hardhat/smart-contracts/AuctionDemo.sol#L104-L120

Vulnerability details

Impact

Bidders's ether could be locked in auctionDemo forever if the auctioned NFT is not claimed.

Proof of Concept

When auction ends, only global amdin or the winner can call claimAuction() to claim the auctioned NFT, all refunds will be returned to all bidders except the winner by iterating through all elements in the array auctionInfoData[_tokenid]. Other bidders have no way to get refund be themself. Moreover, claimAuction() may revert if highestBidder is smart contract which didn't implements IERC721Receiver.onERC721Received(), and all ether received on this auction will be locked in the contract forever.

110:        for (uint256 i=0; i< auctionInfoData[_tokenid].length; i ++) {
111:            if (auctionInfoData[_tokenid][i].bidder == highestBidder && auctionInfoData[_tokenid][i].bid == highestBid && auctionInfoData[_tokenid][i].status == true) {
112：                IERC721(gencore).safeTransferFrom(ownerOfToken, highestBidder, _tokenid);
113:                (bool success, ) = payable(owner()).call{value: highestBid}("");
114:                emit ClaimAuction(owner(), _tokenid, success, highestBid);
115:            } else if (auctionInfoData[_tokenid][i].status == true) {
116:                (bool success, ) = payable(auctionInfoData[_tokenid][i].bidder).call{value: auctionInfoData[_tokenid][i].bid}("");
117:                emit Refund(auctionInfoData[_tokenid][i].bidder, _tokenid, success, highestBid);
118:            } else {}
119:        }

Tools Used

Manual review

Recommended Mitigation Steps

Adding a function to let bidders except the winner can get refund themself after the auction ends.

Assessed type

Other

[c4-pre-sort]

141345 marked the issue as duplicate of #843

[c4-pre-sort]

141345 marked the issue as duplicate of #486

[c4-judge]

alex-ppg marked the issue as not a duplicate

[c4-judge]

alex-ppg marked the issue as duplicate of #1759

[c4-judge]

alex-ppg marked the issue as partial-50

[c4-judge]

alex-ppg changed the severity to 2 (Med Risk)