Starknet Auction

Summary

The bid function incorrectly attempts to transfer ERC20 tokens from the contract to itself instead of from the bidder to the contract.

Vulnerability Details

The bid function uses erc20_dispatcher.transfer(receiver, amount.into());, which transfers tokens from the contract to the receiver (the contract itself). This does not result in the bidder's tokens being transferred to the contract.

Code Reference:

Impact

• Bids Without Payment: Users can place bids without transferring any tokens to the contract.

• Financial Loss to Owner: The auction owner may transfer the NFT without receiving payment.

Recommendations

• Correct Transfer Function Usage: Use transfer_from to transfer tokens from the bidder to the contract:

  // Corrected transfer call

  erc20_dispatcher.transfer_from(sender, receiver, amount.into());

• Require Approval: Ensure that bidders have approved the contract to spend their tokens prior to bidding.