reenttrancy attack
Summary
Vulnerability Details
https://github.com/Cyfrin/2024-10-starknet-auction/blob/main/src/starknet_auction.cairo#L116
The withdraw function allows participants of the auction (both the highest bidder and other bidders) to withdraw their funds after the auction has ended:
-
The NFT owner receives the highest bid.
-
All other bidders are refunded their bid amounts.
but there is a potencial reentrancy in the withdraw logic
Impact
this function does not set the caller bid to 0 after withdrawal allowing a bad user to make multiple withdrawal which can lead to drain of funds
Tools Used
manaul
Recommendations
caller bid should be set to 0 after withdrawal
Lead Judging Commences
Reentrancy in `withdraw` function
The `withdraw` function doesn't reset the `bid_values` to 0 after the withdraw. That means the bidder can call multiple time the `withdraw` function and receive the whole balance of the protocol.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.