Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Front-running Risk in ZENO Token Auction Buy Function

0xkann

Summary

The buy function in the ZENO token auction contract contains a vulnerability that allows a user to front-run other participants. By calling the buy function and purchasing all remaining tokens, the front-runner can prevent others from buying tokens, as there will be none left for subsequent buyers. This issue undermines the fairness of the auction process.

Vulnerability Details

In the buy function, there is a check to ensure that the user cannot buy more tokens than are remaining (require(amount <= state.totalRemaining)). However, there is no mechanism to prevent users from front-running the auction and buying up all the remaining tokens before other users can participate.

  • Front-running Risk: A malicious actor can observe the auction and quickly call the buy function with the exact amount of the remaining tokens, effectively buying all tokens and leaving no tokens for other users. Which will lead to reverted tx of the frontran user

  • Auction Fairness Issue: This enables a user to monopolize the auction, depriving others of the opportunity to buy tokens.

function buy(uint256 amount) external whenActive {
require(amount <= state.totalRemaining, "Not enough ZENO remaining");
uint256 price = getPrice();
uint256 cost = price * amount;
require(usdc.transferFrom(msg.sender, businessAddress, cost), "Transfer failed");
​
bidAmounts[msg.sender] += amount;
state.totalRemaining -= amount;
state.lastBidTime = block.timestamp;
state.lastBidder = msg.sender;
​
zeno.mint(msg.sender, amount);
emit ZENOPurchased(msg.sender, amount, price);
}

Impact

Prevents Fair Participation: The main impact is that the auction becomes unfair. Once the front-runner purchases all remaining tokens, no other user can participate, leading to a skewed auction process.

  • Economic Losses: Other participants may attempt to participate in the auction but will be unable to buy tokens if the front-runner buys all tokens. This could discourage potential buyers from participating in the future.

Tools Used

Manual Review

Recommendations

Consider assigning max tokens that can be bought per user

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.