Starknet Auction
First Flight #26
Beginner FriendlyNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Multiple Withdrawals Allowed After Auction Ends Due to Missing Bid Reset

parmakhanm786

Summary

This bug allows users to repeatedly withdraw funds after the auction ends due to the bid value not being reset. The fix is to set the bid value to zero after withdrawal. It's a high-priority issue.

Vulnerability Details

Repeated Withdrawals: The issue lies in the fact that after a user withdraws their bid amount, the bid_values entry for the user is not reset. As a result, if the user calls the withdraw function multiple times, they can withdraw the same bid amount repeatedly.

Impact

This could lead to significant fund losses from the contract as users would be able to drain more funds than they originally bid.

Steps to Reproduce:

Participate in an auction by placing a bid.
Wait for the auction to end.
Call the withdraw function to successfully withdraw the bid.
Call the withdraw function again (without any check in place to block repeated withdrawal) and notice that the same amount can be withdrawn again.

Tools Used

Manual , VS code

Recommendations

fn withdraw(ref self: ContractState) {
assert(self.started.read(), 'Auction is not started');
assert(self.ended.read(), 'Auction is not ended');
let caller = get_caller_address();
let sender = get_contract_address();
let erc20_dispatcher = IERC20Dispatcher { contract_address: self.erc20_token.read() };
let amount = self.bid_values.entry(caller).read();
let amount_owner = self.highest_bid.read();
if caller == self.nft_owner.read() {
self.highest_bid.write(0);
erc20_dispatcher.transfer_from(sender, caller, amount_owner.into());
}
​
if amount > 0 {
+ // reset the bid value
+ self.bid_values.entry(caller).write(0);
let sender = get_contract_address();
erc20_dispatcher.transfer_from(sender, caller, amount.into());
}
​
self.emit(Withdraw {amount: amount, caller: caller});
}
Updates

Lead Judging Commences

bube Lead Judge 8 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Reentrancy in `withdraw` function

The `withdraw` function doesn't reset the `bid_values` to 0 after the withdraw. That means the bidder can call multiple time the `withdraw` function and receive the whole balance of the protocol.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.