Starknet Auction
First Flight #26
Beginner FriendlyNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Accumulated Bids Not Properly Tracked

adamszymanski

Summary

The contract overwrites bidders' previous bid amounts, failing to accumulate multiple bids from the same bidder.

Vulnerability Details

When a bidder places multiple bids, the contract only records the last bid amount in bid_values, overwriting any previous bids.

Example Scenario:

First bid: 300 tokens
- Contract records: bid_values[bidder] = 300
​
Second bid: 400 tokens
- Contract updates: bid_values[bidder] = 400 (overwrites previous amount)
​
Total transferred by bidder: 700 tokens (300 + 400)
​
Upon withdrawal when bidder loses:
- Bidder can only retrieve 400 tokens (the last recorded amount)
- Bidder loses 300 tokens

Code Reference:

// In bid function
self.bid_values.entry(sender).write(amount);
// Overwrites previous bid amount

Impact

  • Loss of Funds for Bidders: Bidders may not retrieve the total amount they've bid upon withdrawal.

  • Inaccurate Contract State: The contract's records do not reflect the actual amount of tokens received.

Recommendations

  • Accumulate Bids Correctly: Modify the bid recording logic:

// Read the previous bid amount
let previous_amount = self.bid_values.entry(sender).read();
// Accumulate the new bid amount
self.bid_values.entry(sender).write(previous_amount + amount);
Updates

Lead Judging Commences

bube Lead Judge 9 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Wrong bid amount in `bid` function

In the `bid` function the bid values are stored using `self.bid_values.entry(sender).write(amount)` directly, but this overwrites any previous bids made by the same bidder. Therefore if a participant makes 2 or more bids, the participant can then withdraw only the last value of the last bid. That is incorrect, the protocol should save all bids and a participant should withdraw the value of the all unsuccessful bids.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.