Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Auction: Invalid Business Address

destiny

Summary

The Auction contract allows the businessAddress (the recipient of auction proceeds) to be set to an externally owned account (EOA) or an invalid contract address. If funds are sent to an EOA, they may become permanently inaccessible violating the protocol’s financial safeguards.

Code Snippet

Vulnerability Details

Steps to Exploit:

  • A privileged admin accidentally or intentionally configures businessAddress as an EOA (e.g., a user’s wallet) instead of a verified contract (e.g., a Treasury or multi-sig).

  • Auction Execution: Users buy ZENO tokens, and funds are sent to the invalid businessAddress.

  • Funds Lost: Since the EOA cannot process incoming USDC transfers (e.g., lacks transferFrom logic), funds are permanently stuck.

Code Proof:

In Auction.sol, businessAddress is assigned without validation:

constructor(...) {
businessAddress = _businessAddress; // No check if address is a contract
}
​
function buy(...) external {
usdc.transferFrom(msg.sender, businessAddress, cost); // Funds sent blindly
}

Attack Simulation:

  • Deployment exploit:

// Deploy Auction with EOA as businessAddress
new Auction(..., 0x123... (EOA), ...);

  • User Participation: Alice buys 100 ZENO tokens, sending 10,000 USDC to 0x123....

Result: The USDC is trapped in the EOA, rendering protocol funds irrecoverable.

Impact

  1. Permanent Fund Loss: Assets sent to EOAs cannot be programmatically recovered.

  2. Protocol Insolvency: If businessAddress holds critical reserves, the protocol may collapse.

  3. Reputation Damage: Users lose trust in the protocol’s ability to safeguard funds.

Tools Used

Manual review

Recommendations

  • Validate businessAddress as a contract, Use OpenZeppelin’s Address library to ensure businessAddress is a contract:

import "@openzeppelin/contracts/utils/Address.sol";
​
constructor(...) {
require(Address.isContract(_businessAddress), "businessAddress must be a contract");
businessAddress = _businessAddress;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.