Starknet Auction
First Flight #26
Beginner FriendlyNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Bidders can lose tokens if they bid multiple times

olugbenga

Summary

The bid functions allows the bidder to lose their previous bid if they bid multiple times for an auction

Vulnerability Details

The bid function doesn't prevent a bidder from bidding more than once, however, multiple bids from the same bidder will lead to the user losing their previous bid as it overwrites the previous bid

fn bid(ref self: ContractState, amount: u64) {
....
let current_bid = self.highest_bid.read();
....
self.bid_values.entry(sender).write(amount);
self.emit(NewHighestBid {amount: self.highest_bid.read(), sender: sender});
self.highest_bidder.write(sender);
self.highest_bid.write(amount);
....
}
​

Impact

Loss of ERC20 tokens for any user bidding multiple times

Tools Used

Manual

Recommendations

either prevent a user from bidding multiple times or update their records and not overwrite them.

Updates

Lead Judging Commences

bube Lead Judge 8 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Wrong bid amount in `bid` function

In the `bid` function the bid values are stored using `self.bid_values.entry(sender).write(amount)` directly, but this overwrites any previous bids made by the same bidder. Therefore if a participant makes 2 or more bids, the participant can then withdraw only the last value of the last bid. That is incorrect, the protocol should save all bids and a participant should withdraw the value of the all unsuccessful bids.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.