Submission Details
Severity:
Lack of Access Control on 'auctionEnd'
Summary
There's no access control mechanism preventing anyone from ending the auction or claiming tokens. Only the owner can end the auction, but anyone can claim tokens after the auction ends.
Vulnerability Details
Impact
Any external user can call the auctionEnd function to finalize the auction.
Tools Used
Recommendations
Mitigation: Add a modifier that restricts this function to the owner, or carefully review the potential implications of allowing anyone to call it.
modifier onlyOwner() {
require(msg.sender == owner, "Not owner");
_;
}
function auctionEnd() external onlyOwner {
// Logic...
}
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
66230 USDC / LOC
16,000 USDC
2,500 USDC
1,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.