Starknet Auction
First Flight #26
Beginner FriendlyNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Funds will get struck in the contract if there are multiple unsuccessful bids for the same user

p4y4bl3

Summary

If the same person bids multiple bids, then he can only be able to withdraw the latest bid. All the remaining previous bids will be struck in the contract

Vulnerability Details

If any user bids multiple bids, after completion of auction he can only be able to withdraw his latest bid.. This make all his previous bids funds get struck in the contract

Impact

Loss of funds to the users who have multiple bids

Tools Used

Manual Inspection

Recommendations

To fix this issue whenever a person who has previous bid, while placing new bid, have to only send the remaining amount instead of whole amount.

fn bid(ref self: ContractState, amount: u64) {
let time = get_block_timestamp();
let erc20_dispatcher = IERC20Dispatcher { contract_address: self.erc20_token.read() };
let sender = get_caller_address();
let receiver = get_contract_address();
let current_bid = self.highest_bid.read();
assert(self.started.read(), 'Auction is not started');
assert(time < self.bidding_end.read(), 'Auction ended');
assert(amount > current_bid, 'The bid is not sufficient');
self.bid_values.entry(sender).write(amount);
self.emit(NewHighestBid {amount: self.highest_bid.read(), sender: sender});
self.highest_bidder.write(sender);
self.highest_bid.write(amount);
​
if self.bid_values.entry(caller).read() == 0{
erc20_dispatcher.transfer(receiver, amount.into());
}else{
let previous_amount = self.bid_values.entry(caller).read();
erc20_dispatcher.transfer(receiver, amount.into() - previous_amount);
}
}
Updates

Lead Judging Commences

bube Lead Judge 9 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Wrong bid amount in `bid` function

In the `bid` function the bid values are stored using `self.bid_values.entry(sender).write(amount)` directly, but this overwrites any previous bids made by the same bidder. Therefore if a participant makes 2 or more bids, the participant can then withdraw only the last value of the last bid. That is incorrect, the protocol should save all bids and a participant should withdraw the value of the all unsuccessful bids.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.