Starknet Auction
First Flight #26
Beginner FriendlyNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Person who wins the bid will still withdraw his tokens after the completion of auction

p4y4bl3

Summary

A person who wins the auction can still able to withdraw his bid tokens instead of sending this amount to the protocol owner

Vulnerability Details

By this issue an attack will tries to win the auction by placing bids with higher higher amounts. As anyways at the end he will still able to withdraw his bid tokens

Impact

The protocol owner cannot able to get the highest bid amount value after the completion of the auction

Tools Used

Manual Inspection

Recommendations

Also add check by not allowing users to claim mutliple times

fn withdraw(ref self: ContractState) {
assert(self.started.read(), 'Auction is not started');
assert(self.ended.read(), 'Auction is not ended');
let caller = get_caller_address();
let sender = get_contract_address();
let erc20_dispatcher = IERC20Dispatcher { contract_address: self.erc20_token.read() };
let amount = self.bid_values.entry(caller).read();
let amount_owner = self.highest_bid.read();
if caller == self.nft_owner.read() {
self.highest_bid.write(0);
+ return
- erc20_dispatcher.transfer_from(sender, caller, amount_owner.into());
}
​
if amount > 0 {
let sender = get_contract_address();
+ self.bid_values.entry(caller).write(0);
erc20_dispatcher.transfer_from(sender, caller, amount.into());
}
​
self.emit(Withdraw {amount: amount, caller: caller});
}
Updates

Lead Judging Commences

bube Lead Judge 9 months ago
Submission Judgement Published
Validated
Assigned finding tags:

The `highest_bidder` can withdraw the value of all bids

The `withdraw` function allows the participants to receive back the value of all their unsuccessful bids. The problem is that the winner of the auction will receive all bids including the `highest_bid` that should be paid to the NFT owner.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.