Bidders may end up bidding in the wrong epoch
Summary
DaiGoldAuction.bid() and SpiceAuction.bid() don't let the bidders choose which epoch they wish to bid in. Because of this a bidder may end up bidding in a less favorable epoch.
Vulnerability Details
Transactions may stay in the mempool for a long time. There are different reasons for why this may happen - network congestion, block stuffing attack, too low gas paid, etc..
If Alice sees epoch X is an epoch with a lot of rewards, she may decide to bid. If her transaction stays for too long, her bid may be executed in epoch X + 1, for example.
Impact
Bidding executed in an unexpected epoch.
Tools Used
Manual Review
Recommendations
Add an epoch parameter to the bid functions that must be equal to the current epoch.
Lead Judging Commences
bid should have epochId as input to avoid bidding for the next auction if bid is called at cutoff.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.