Starknet Auction
First Flight #26
Beginner FriendlyNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Highest bidders can withdraw their bids after auction ends

olugbenga

Summary

The highest bidder can withdraw their bids back even after winning the auction and getting the auction nft

Vulnerability Details

The auction's highest bidder gets the auction NFT when the function ends while the auction owner gets the highest bid. However, the current implementation of the withdraw function allows the highest bidder to get both the NFT and the bid.

fn withdraw(ref self: ContractState) {
....
let amount = self.bid_values.entry(caller).read();
....
if amount > 0 {
let sender = get_contract_address();
erc20_dispatcher.transfer_from(sender, caller, amount.into());
}
....
}

Impact

The highest bidder can withdraw their bid, this will either prevent other bidders from withdrawing their bids or the auction owner from withdrawing the highest bid.

Tools Used

Manual

Recommendations

Updates

Lead Judging Commences

bube Lead Judge 8 months ago
Submission Judgement Published
Validated
Assigned finding tags:

The `highest_bidder` can withdraw the value of all bids

The `withdraw` function allows the participants to receive back the value of all their unsuccessful bids. The problem is that the winner of the auction will receive all bids including the `highest_bid` that should be paid to the NFT owner.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.