In withdraw()
a bidder is able to withdraw more than the amount they deposited for a bid.
On lines 131 - 134 a bidder is allowed to withdraw their bid amount if they had a losing bid. However, the code does not zero out their balance after amount
is returned to them. This means that the bidder still has a positive balance after the withdrawal.
The bidder will be able to recall withdraw()
over and over and withdraw amount
worth of tokens and deplete the contract of its balance.
Manual Review
Update the code on lines 131 - 134 by adding the following after line 132: self.bid_values.entry(caller).write(0);
The `withdraw` function doesn't reset the `bid_values` to 0 after the withdraw. That means the bidder can call multiple time the `withdraw` function and receive the whole balance of the protocol.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.