Starknet Auction

Summary

The constructor function does not validate whether the addresses provided for the ERC20 and ERC721 tokens are valid contracts. This could lead to the contract interacting with incorrect or malicious token contracts.

Vulnerability Details

In the constructor:

There is no validation to ensure that erc20_token and erc721_token are actual token contracts. A malicious actor could provide addresses that don’t conform to the expected interfaces, potentially leading to undefined behavior or contract malfunction.

Impact

If invalid or malicious contract addresses are provided, the auction could fail to properly transfer tokens (either bids or NFTs), leading to loss of assets or broken functionality.

Tools Used

• Manual code review

Recommendations

• Add checks to validate that the provided ERC20 and ERC721 addresses implement the expected token standards. For example, use a function that checks if these addresses respond to the standard ERC20/ERC721 interface methods.

• You could consider adding a try/catch mechanism (if supported) or use a function that verifies token interfaces before assigning the contract addresses.