Starknet Auction
First Flight #26
Beginner FriendlyNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Multiple Withdrawals Possible Due to Missing State Update

adamszymanski

Summary

After a withdrawal, bidders' balances are not reset, allowing them to withdraw the same amount multiple times.

Vulnerability Details

The withdraw function does not reset bid_values[caller] to zero after a successful withdrawal.

Code Reference:

// In withdraw functionlet
amount = self.bid_values.entry(caller).read();
// No update to reset bid_values[caller] to zero

Impact

  • Potential for Fraud: Bidders can repeatedly withdraw funds.

  • Contract Insolvency Risk: The contract may become insolvent.

Recommendations

  • Reset Bidder Balance: After transferring tokens back to the bidder, reset their balance:

if amount > 0 {
// Transfer tokens to the bidder
erc20_dispatcher.transfer_from(sender, caller, amount.into()); \
// Reset bidder's balance to zero
self.bid_values.entry(caller).write(0);
}
Updates

Lead Judging Commences

bube Lead Judge
9 months ago
bube Lead Judge 9 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Reentrancy in `withdraw` function

The `withdraw` function doesn't reset the `bid_values` to 0 after the withdraw. That means the bidder can call multiple time the `withdraw` function and receive the whole balance of the protocol.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.