Submission Details
Severity:
Auction owner can withdraw starting bid
Summary
The withdraw function allows the auction owner to withdraw the starting bid if there's no bid.
Vulnerability Details
The value of the highest_bidin the withdraw function for auctions without bids is the starting _bidthat was set by the owner in the function startand should not be withdrawable but the current implementation allows is if there are any existing ERC20 token in the contract
fn withdraw(ref self: ContractState) {
....
let amount_owner = self.highest_bid.read();
if caller == self.nft_owner.read() {
self.highest_bid.write(0);
erc20_dispatcher.transfer_from(sender, caller, amount_owner.into());
}
....
}
Impact
Loss of ERC20 tokens in the contract
Tools Used
Manual
Recommendations
Rewards breakdown
nSLOC
132This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.