Submission Details
Severity:
Missing Maximum Bidding Duration Limit
Summary
The contract lacks validation for the maximum bidding duration, allowing the auction owner to set excessively long or practically eternal auction durations.
Vulnerability Details
In the start function, the bidding_duration parameter is not validated against any maximum limit.
Code Reference:
// In start function
fn start(ref self: ContractState, bidding_duration: u64, starting_bid: u64) {
// Missing validation for bidding_duration
}
Impact
An infinite auction duration can lock the NFT and bidders' funds indefinitely, leading to a denial of service for all participants.
Recommendations
Introduce a maximum bidding duration limit by adding a validation check:
const MAX_DURATION: u64 = /* appropriate max duration */;
assert(bidding_duration > 0 && bidding_duration <= MAX_DURATION, 'Invalid bidding duration');
Define
MAX_DURATIONbased on reasonable auction time frames, such as a few days or weeks.
Rewards breakdown
nSLOC
132This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.