Owner will prevent the NFT claim by highest bidder.

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/AuctionDemo.sol#L104-L120

Vulnerability details

Impact

The highest bidder can not claim the NFT despite they paid enough amount.

Proof of Concept

Once the auction time is over, either the admin or the highest bidder can call the function claimAuction to claim the NFT.

Firs the NFT is sent to the highest bidder and then the highest bid is sent to the owner.

The owner can intentionally consume most of the gas while receiving the highest bid amount. This will lead to a situation where the highest bidder can not claim the NFT.

https://github.com/code-423n4/2023-10-nextgen/blob/8b518196629faa37eae39736837b24926fd3c07c/smart-contracts/AuctionDemo.sol#L104-L120

    function claimAuction(uint256 _tokenid) public WinnerOrAdminRequired(_tokenid,this.claimAuction.selector){
        require(block.timestamp >= minter.getAuctionEndTime(_tokenid) && auctionClaim[_tokenid] == false && minter.getAuctionStatus(_tokenid) == true);
        auctionClaim[_tokenid] = true;
        uint256 highestBid = returnHighestBid(_tokenid);
        address ownerOfToken = IERC721(gencore).ownerOf(_tokenid);
        address highestBidder = returnHighestBidder(_tokenid);
        for (uint256 i=0; i< auctionInfoData[_tokenid].length; i ++) {
            if (auctionInfoData[_tokenid][i].bidder == highestBidder && auctionInfoData[_tokenid][i].bid == highestBid && auctionInfoData[_tokenid][i].status == true) {
                IERC721(gencore).safeTransferFrom(ownerOfToken, highestBidder, _tokenid);
                (bool success, ) = payable(owner()).call{value: highestBid}(""); -------------->> most of the gas would be consumed here.
                emit ClaimAuction(owner(), _tokenid, success, highestBid);
            } else if (auctionInfoData[_tokenid][i].status == true) {
                (bool success, ) = payable(auctionInfoData[_tokenid][i].bidder).call{value: auctionInfoData[_tokenid][i].bid}("");
                emit Refund(auctionInfoData[_tokenid][i].bidder, _tokenid, success, highestBid);
            } else {}
        }
    }

Since all most of the gas consumed inside the caller, the transaction would revert while trying to process further transaction in the else if block.

Tools Used

Manual review

Recommended Mitigation Steps

We suggest to add separate function for claiming the highest bid amount by the owner.
Remove the fund fund transfer call from claimAuction function call.

Assessed type

Rug-Pull

[c4-pre-sort]

141345 marked the issue as duplicate of #1653

[c4-pre-sort]

141345 marked the issue as duplicate of #843

[c4-pre-sort]

141345 marked the issue as duplicate of #486

[c4-judge]

alex-ppg marked the issue as not a duplicate

[alex-ppg]

The Warden specifies that the owner of the contract can consume gas, leading to a DoS attack on the claimAuction function.

The owner (as well as the auctioned token owner if the code would be corrected) is a trusted party per NextGen's responses throughout the contest, rendering this exhibit to be invalid. A gas-based attack is indeed possible as #734 specifies, however, this particular submission relies on a NextGen affiliated member misbehaving which is not a valid assumption.

[c4-judge]

alex-ppg marked the issue as unsatisfactory:
Invalid