Core Contracts

Summary

The ZENO auction's buy function is vulnerable to a mempool delay attack, where a malicious actor can intentionally delay another user's transaction. By exploiting mempool ordering and network fee dynamics, the attacker can cause a victim's transaction to execute at a later block timestamp, leading to a higher token price calculation and forcing the user to pay more USDC than anticipated because of the getPrice() function.

Vulnerability Details

The buy function calculates the cost of tokens based on the current block timestamp using the getPrice() function. This time-dependent pricing mechanism introduces an exploitable window where:

• Delayed Execution: A malicious user can manipulate the transaction ordering in the mempool. By using higher gas prices or strategically timing their transactions, the attacker can cause a victim's transaction to be delayed.

• Price Increase Over Time: Since the token price is recalculated at the time of execution, any delay in the victim's transaction causes the getPrice() function to use a later timestamp. If the auction pricing model increases the token price over time, the victim ends up paying more than expected.

• Exploitation Techniques: The attacker can monitor the mempool for pending transactions from users and then broadcast high-priority transactions (or even bribe miners) to ensure that the victim’s transaction is pushed to a later block. This manipulation directly impacts the computed cost within the buy function.

Impact

Financial Loss for Users: Victims may end up paying significantly more USDC than they originally intended due to the increased price when their transaction is eventually executed.

Tools Used

Manual Review

Recommendations