Summary

In SpiceAuction::removeAuctionConfig, there is a possibility that the configuration removed is not the one for the current epoch but for the following one incurring in a possible error.

Vulnerability Details

When removeAuctionConfig is invoked, two scenarios are considered:

• startAuction is triggered but the auction is in cooldown period.

• startAuction is not triggered but auctionConfig is set although _currentEpochIdis not updated yet.
  In the first scenario, the auction configuration for the current auction (while in cooldown) is removed.
  In the second scenario, the configuration for the next epoch is removed before startAuction is called hence startAuction cannot be invoked until a new configuration is set.
  There is, however, a third scenario which is not considered. This scenario is a combination of the other two scenarios:

• startAuction is triggered but the auction is in cooldown period.

• setAuctionConfig is invoked setting the configuration for the next epoch.
  In this scenario, both configurations (current and next epoch) can be removed but if removeAuctionConfig is invoked, only the next epoch configuration will be removed. removeAuctionconfig will have to be invoked a second time in order to remove the current epoch configuration. This behaviour could mistakenly remove a configuration other than the intended one.

Proof of Concept

Add this test to SpiceAuction.t.sol

Impact

Trying to remove current epoch auction (i.e. startAuction triggered) but inadvertently removing a different than intended auction configuration (i.e. next epoch configuration).

Tools Used

Foundry

Recommendations

In the scenario where both, current epoch and next epoch configurations can be removed, make sure there is no possible mistake by either removing both or let the user select which one to remove.