The Highest Bidder Can Withdraw Their Bid
Summary
Thie highst bidder is able to withdraw their bid after the auction has ended.
Vulnerability Details
After the highest bidder has won the auction they are able to withdraw their bid before the owner is able to collect the winnings.
Impact
This means that the highest bidder will have won the NFT and is still able to withdraw their winning bid from the smart contract essentially stealing the NFT.
Tools Used
Manual Review
Recommendations
Update line 131 to the following: : if amount > 0 && caller != self.highest_bidder.read()
Lead Judging Commences
The `highest_bidder` can withdraw the value of all bids
The `withdraw` function allows the participants to receive back the value of all their unsuccessful bids. The problem is that the winner of the auction will receive all bids including the `highest_bid` that should be paid to the NFT owner.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.