Starknet Auction

Summary

The contract provides no confidentiality protection on the bidding process which allows other participants to exploit in-flight bid transactions.

Vulnerability Details

The bidding process is a transparent one; meaning everyone can see the bid amount by every bidder. This includes in-flight transactions (in memory pool). An observer can front-run the transaction by using another transaction with the same bid amount so that the victim's bid is rejected. This also means that an optimum price may not be created for the auctioned item.

Impact

The victim's bid is rejected. Less fairness to the auction process.

Tools Used

Manual review.

Recommendations

Consider implementing a more advanced technique to provide confidentiality, such as commit-reveal scheme.