Starknet Auction
First Flight #26
Beginner FriendlyNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Unhandled No-Bid Scenario in End Function

abhishekthakur

Summary

The end function doesn't handle the case where no bids were placed, potentially locking the NFT in the contract.

Vulnerability Details

https://github.com/Cyfrin/2024-10-starknet-auction/blob/main/src/starknet_auction.cairo#L139-L155

The end function doesn't handle the case where no bids were placed. It only checks if the highest bid is greater than the starting price:

assert(self.starting_price.read() < self.highest_bid.read(), 'No bids');

If no bids were placed, the highest bid would equal the starting price, causing this assertion to fail but not handling the return of the NFT to the original owner.

POC

#[test]
fn test_end_with_no_bids() {
let (auction_dispatcher, auction_contract, _, erc721_contract_address) = deploy_auction_contract();
auction_dispatcher.start(86400, 10);
​
let time = get_block_timestamp();
start_cheat_block_timestamp(auction_contract, time + 86401);
​
let erc721_dispatcher = IERC721Dispatcher { contract_address: erc721_contract_address };
let initial_owner = erc721_dispatcher.owner_of(1);
​
auction_dispatcher.end();
​
let final_owner = erc721_dispatcher.owner_of(1);
assert(final_owner == initial_owner, 'NFT should return to original owner if no bids');
}

Impact

If no bids are placed, the NFT could be locked in the contract indefinitely, causing loss of the asset for the original owner.

Tools Used

Manual Review

Recommendations

Modify the end function to return the NFT to the original owner if no bids were placed.

Updates

Lead Judging Commences

bube Lead Judge 9 months ago
Submission Judgement Published
Validated
Assigned finding tags:

The NFT will be locked if there are no bids

If there are no placed bids in the auction, the `end` function will always revert. The owner can not receive back the nft ant it will be locked in the contract.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.