Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

will result in a lockup of funds for the entire contract #61

Closed
c4-submissions opened this issue Nov 1, 2023 · 6 comments
Closed

will result in a lockup of funds for the entire contract #61

c4-submissions opened this issue Nov 1, 2023 · 6 comments
Labels
3 (High Risk) Assets can be stolen/lost/compromised directly bug Something isn't working duplicate-1785 edited-by-warden unsatisfactory does not satisfy C4 submission criteria; not eligible for awards

Comments

@c4-submissions
Copy link
Contributor

c4-submissions commented Nov 1, 2023

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/main/smart-contracts/AuctionDemo.sol#L116

Vulnerability details

Impact

This vulnerability will cause the funds of the contract to be locked up

Proof of Concept

An attacker can use the attack contract to participate in the bidding by ensuring that the attack contract enters a little bit of money into the bidding, and then writing receive() in the attack contract and revert() in that function to ensure that the attack contract can't accept an Ether transfer.
Since the claimAuction function sends bidders' funds in batches after the auction, if one of them refuses, it will cause the entire transaction to be rolled back, locking the funds in the contract.

contract poc{
    constructor(address auctionDemo,uint256 tokenid) public payable{
        auctionDemo.call{value: msg.value}(abi.encodeWithSignature("participateToAuction(uint256)",tokenid));
    }
    receive() external payable {
        revert();
    }
}

Tools Used

foundry

Recommended Mitigation Steps

Disable contract calls

Assessed type

DoS

@c4-submissions c4-submissions added 3 (High Risk) Assets can be stolen/lost/compromised directly bug Something isn't working labels Nov 1, 2023
c4-submissions added a commit that referenced this issue Nov 1, 2023

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
@c4-pre-sort
Copy link

141345 marked the issue as duplicate of #1632

@c4-pre-sort
Copy link

141345 marked the issue as duplicate of #843

@c4-pre-sort
Copy link

141345 marked the issue as duplicate of #486

@c4-judge c4-judge reopened this Dec 5, 2023
@c4-judge
Copy link

c4-judge commented Dec 5, 2023

alex-ppg marked the issue as not a duplicate

@c4-judge c4-judge closed this as completed Dec 5, 2023
@c4-judge
Copy link

c4-judge commented Dec 5, 2023

alex-ppg marked the issue as duplicate of #1785

@c4-judge
Copy link

c4-judge commented Dec 8, 2023

alex-ppg marked the issue as unsatisfactory:
Out of scope

@c4-judge c4-judge added the unsatisfactory does not satisfy C4 submission criteria; not eligible for awards label Dec 8, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
3 (High Risk) Assets can be stolen/lost/compromised directly bug Something isn't working duplicate-1785 edited-by-warden unsatisfactory does not satisfy C4 submission criteria; not eligible for awards
Projects
None yet
Development

No branches or pull requests

4 participants