[EVMN] Higgest Bidder Can Withdraw Asset
Summary
A highest bidder (the auction winner) can withdraw assets, which means they can get the auctioned item for free.
Vulnerability Details
The function withdraw() will be active once function end() is successfully executed.
However, it does not prevent the auction winner (the highest_bidder) from withdrawing asset. If this occurs, then the highest bidder gets the auctioned item for free. The contract will not be able to return the assets of the losing bidders in full if the auction owner also withdraws.
Impact
The auction winner gets free item.
Tools Used
Manual review.
Recommendations
Consider preventing the auction winner from withdrawing.
Lead Judging Commences
The `highest_bidder` can withdraw the value of all bids
The `withdraw` function allows the participants to receive back the value of all their unsuccessful bids. The problem is that the winner of the auction will receive all bids including the `highest_bid` that should be paid to the NFT owner.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.