Starknet Auction
First Flight #26
Beginner FriendlyNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Auction contract prevents NFT recovery if no bids are received.

v1vah0us3

Vulnerability Details

The end function contains an assertion that prevents the auction from being concluded if no bids have been placed. Specifically, the end function includes the following line:

assert(self.starting_price.read() < self.highest_bid.read(), 'No bids');

If no bids have been placed, the highest_bid will remain at its initial value, which is equal to the starting_price value set by the owner in the start function. This will cause the assertion to fail, reverting the transaction. As a result, the auction owner will not be able to end the auction, leaving the NFT stuck in the contract without a means of recovery.

Impact

The inability to close the auction with no bids exposes the auction owner to significant risk, as the NFT could be permanently locked into the contract, potentially resulting in significant financial loss to the owner.

Tools Used

Manual Code Review, VSCode

Recommendations

To address this vulnerability, the following changes are recommended to the end function:

fn end(ref self: ContractState) {
let time = get_block_timestamp();
let caller = get_caller_address();
let erc721_dispatcher = IERC721Dispatcher { contract_address: self.erc721_token.read() };
let sender = get_contract_address();
assert(caller == self.nft_owner.read(), 'Not the nft owner');
assert(self.started.read(), 'Auction is not started');
assert(time >= self.bidding_end.read(), 'Auction is not yet ended');
assert(!self.ended.read(), 'Auction end is already called');
- assert(self.starting_price.read() < self.highest_bid.read(), 'No bids');
+ assert(self.starting_price.read() <= self.highest_bid.read(), 'No bids');
self.ended.write(true);
self.emit(End {highest_bid: self.highest_bid.read(), highest_bidder: self.highest_bidder.read()});
erc721_dispatcher.transfer_from(sender, self.highest_bidder.read(), self.nft_id.read().into());
}

This would allow the auction to be ended even if no bids have been placed.

Updates

Lead Judging Commences

bube Lead Judge 9 months ago
Submission Judgement Published
Validated
Assigned finding tags:

The NFT will be locked if there are no bids

If there are no placed bids in the auction, the `end` function will always revert. The owner can not receive back the nft ant it will be locked in the contract.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.