Submission Details
Severity:
Not only the auction owner can end the auction after the previously established time
Summary
The auctionEnd() function is accessible to everyone after the auction contract is created, meaning that anyone can call it and end the auction at any chosen moment. All functions affecting the course of the auction should be secured with appropriate access controls.
Vulnerability Details
Anyone can end the auction after its allotted time has expired.
POC
function testEndAuction() public {
address bidder = address(0x2);
vm.startPrank(bidder);
auction.auctionEnd();
vm.stopPrank();
Impact
Anyone can end the auction after its allotted time has expired.
Tools Used
Manual Review, Foundry
Recommendations
You should add an Access Control mechanism to the auctionEnd function so that the decision to end the auction is reserved exclusively for the auction owner.
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
66230 USDC / LOC
16,000 USDC
2,500 USDC
1,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.