First Flight #13: Baba Marta

Summary

MEV attack in MartenitsaVoting::announceWinner - the attacker gets the reward or DoS the contract.

Vulnerability Details

Just before the winner is announced, the attacker will buy the winning token by MartenitsaMarketplace::buyMartenitsa and the token will be deleted from the tokenIdToListing mapping. The attacker will make his transaction go before the announceWinner transaction.

Now the attacker has two choices:

1. List the token again in the MartenitsaMarketPlace and then the HealthToken reward will go to the attacker instead of the actual winner

2. Don't list the token again and DOS the MartenitsaVoting::announceWinner. When MartenitsaMarketPlace::getListing is called in MartenitsaVoting::accounceWInner, the function will revert, because it expects that the token is listed for sale - require(listing.forSale, "Token is not listed for sale");

Impact

The attacker will get the reward instead of the actual winner or will DoS the MartenitsaVoting::announceWinner.
The voting can't be started again because as it is stated in the README - The voting takes place only once.

Tools Used

Manual Review

Recommendations

Use Flashbots or change the rules that not only listed for sale tokens can participate in the vote.
The second option is recommended as this issue can happen also without MEV attack, though it is a bit harder to execute.
But if there is small amount of time until the deadline and there is a clear leader in the voting, the same thing can be achieved without MEV.