The contract allows the auction owner to bid on their own auction and withdraw funds, enabling artificial inflation of the auction price without financial risk.
Owner Bidding: There is no check to prevent the auction owner from placing bids.
Artificial Price Inflation: The owner can bid a higher amount to outbid others. Due to flaws in the withdraw
function, the owner can later withdraw their bid, effectively manipulating the auction price without cost.
Unfair Auction Manipulation: Misleads other bidders and undermines the integrity of the auction.
Funds Retrieval: The owner retrieves their bid amount through the flawed withdraw
function, nullifying any financial commitment.
Prevent Owner from Bidding: Add a check in the bid
function:
Fix Withdrawal Logic: Update the withdraw
function to prevent the highest bidder (who could be the owner) from withdrawing their bid (see issue Highest Bidder Can Withdraw Their Bid
for details).
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.