Starknet Auction
First Flight #26
Beginner FriendlyNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Bidders can withdraw their bids multiple times

olugbenga

Summary

The withdraw function allows bidders to withdraw their bids when the auction has ended, however, the bid_valuesstate variable isn't updated, thus allowing bidders to keep withdrawing till the contract is drained.

Vulnerability Details

The function transfers a bidder's bid to the bidder after the auction has ended but the bid_valuesis not being set to zero. This allows a bidder to withdraw multiple times.

fn withdraw(ref self: ContractState) {
....
let amount = self.bid_values.entry(caller).read();
....
​
if amount > 0 {
let sender = get_contract_address();
erc20_dispatcher.transfer_from(sender, caller, amount.into());
}
​
self.emit(Withdraw {amount: amount, caller: caller});
}

Impact

Bidders can withdraw more than their bids

Tools Used

Manual

Recommendations

bid_valuesshould be set to 0

Updates

Lead Judging Commences

bube Lead Judge 9 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Reentrancy in `withdraw` function

The `withdraw` function doesn't reset the `bid_values` to 0 after the withdraw. That means the bidder can call multiple time the `withdraw` function and receive the whole balance of the protocol.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.