Starknet Auction
First Flight #26
Beginner FriendlyNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

ERC20 Token Transfer Vulnerability

shellh4wks

ERC20 Token Transfer Vulnerability

The transfer and transfer_from operations assume the bidder has enough funds, but there’s no validation before transferring tokens. If the ERC20 transfer fails (due to insufficient balance or lack of allowance), the state may still be updated, leading to incorrect bid tracking.

Impact

  • If the ERC20 transfer fails, the state (such as highest_bid and bid_values) will still reflect the new bid. This could allow invalid bids to remain recorded.

  • Auction integrity is compromised: The highest bid may not actually exist in the ERC20 token contract, but the auction treats it as valid.

Mitigation Strategy

  • Introduce a pre-check for ERC20 balance and allowance before accepting a bid.

  • If the check fails, the bid should not be accepted.

Proposed Code Fix

fn bid(ref self: ContractState, amount: u64) {
let time = get_block_timestamp();
let erc20_dispatcher = IERC20Dispatcher { contract_address: self.erc20_token.read() };
let sender = get_caller_address();
let receiver = get_contract_address();
let current_bid = self.highest_bid.read();
let previous_bid = self.bid_values.entry(sender).read();
​
assert(self.started.read(), 'Auction is not started');
assert(time < self.bidding_end.read(), 'Auction ended');
assert(amount + previous_bid > current_bid, 'The bid is not sufficient');
​
// Check that the sender has enough balance and allowance
let balance = erc20_dispatcher.balance_of(sender);
let allowance = erc20_dispatcher.allowance(sender, receiver);
assert(balance >= amount, 'Insufficient balance');
assert(allowance >= amount, 'Insufficient allowance');
​
self.bid_values.entry(sender).write(previous_bid + amount);
​
self.emit(NewHighestBid { amount: previous_bid + amount, sender });
​
self.highest_bidder.write(sender);
self.highest_bid.write(previous_bid + amount);
​
erc20_dispatcher.transfer(receiver, amount.into());
}

With these pre-checks:

  • The bid will only be accepted if the user has enough balance and allowance.

  • This prevents failed ERC20 transfers from corrupting the auction state.

Updates

Lead Judging Commences

bube Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.