Attacker can game the auction, resulting in either winning the NFT at 1 wei or freezing the funds!

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/main/smart-contracts/AuctionDemo.sol#L116

Vulnerability details

Impact

Attacker can game the auction, resulting in either winning the NFT at 1 wei or freezing the funds!

Proof of Concept

1. Auction for a tokenId(NFT) starts.
2. Attacker front-runs everybody to participate in the auctions, by bidding a minimal amount of 1 wei
3. If Nobody Participates in the auction, the Attacker just gets the NFT at 1 wei
4. If somebody participates with a higher bid, the Attacker can just consume all the gas at the time of refund, reverting the transaction to claimAuction and freezing the funds of everybody!
5. This results in a win-win situation for the attacker, where he either freezes funds or ends up getting the NFT for a very unreasonable price!

The attacker can do this for every tokenId that comes to the auction, resulting in getting NFT in all the auctions at a minimum price or freezing participants' funds!

Tools Used

Manual

Recommended Mitigation Steps

A fixed amount of gas should be passed to the receiver at the time of refund.

Assessed type

ETH-Transfer

[c4-pre-sort]

141345 marked the issue as duplicate of #486

[c4-judge]

alex-ppg marked the issue as not a duplicate

[c4-judge]

alex-ppg marked the issue as duplicate of #2006

[c4-judge]

alex-ppg marked the issue as unsatisfactory:
Out of scope

[c4-judge]

alex-ppg marked the issue as unsatisfactory:
Out of scope