Summary

SpiceAuction and DaiGoldAuction's bid should have a deadline or epochId to prevent users from accidentally bidding on the next auction during slight network congestion.

Vulnerability Details

The bid function lacks deadline protection. During network congestion, some users may end up bidding for the next auction if their transaction is delayed.

Example:

1. Alice bids for auction X near its end because she likes its terms.

2. Her transaction gets delayed due to low gas or network congestion.

3. A new auction Y starts.

4. Alice's bid transaction finally gets executed, but the bid is for auction Y instead of auction X.

Impact

User funds are at risk because slight network congestion can cause users to bid on the wrong auction.

Tools Used

Manual review

Recommendations

Add epochId to the bid and ensure it matches the current epoch. This will guarantee that users are bidding on the correct auction.