Starknet Auction

First Flight #26
Beginner FriendlyNFT
100 EXP
View results
Submission Details
Severity: high
Invalid

[EVMN] Potential Front-Run On `bid()` Transaction

Summary

The contract provides no confidentiality protection on the bidding process which allows other participants to exploit in-flight bid transactions.

Vulnerability Details

The bidding process is a transparent one; meaning everyone can see the bid amount by every bidder. This includes in-flight transactions (in memory pool). An observer can front-run the transaction by using another transaction with the same bid amount so that the victim's bid is rejected. This also means that an optimum price may not be created for the auctioned item.

Impact

The victim's bid is rejected. Less fairness to the auction process.

Tools Used

Manual review.

Recommendations

Consider implementing a more advanced technique to provide confidentiality, such as commit-reveal scheme.

Updates

Lead Judging Commences

bube Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.