Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

`Auction#checkAuctionEnded()` can be called multiple times leading to redundant event emissions and potential gas wastage

safdie

Summary

he checkAuctionEnded function in the Auction contract can be called multiple times, leading to redundant event emissions and potential gas wastage. While this does not directly impact security, it creates inefficiencies and unnecessary costs for users and network congestion.

Vulnerability Details

The following code snippet demonstrates the issue:

function checkAuctionEnded() external {
require(block.timestamp >= state.endTime, "Auction not ended");
emit AuctionEnded(getPrice());
}

  • The function does not restrict multiple calls, meaning any user can call it repeatedly after the auction ends, causing unnecessary event emissions.

  • This can lead to network spam and increased on-chain data storage requirements.

  • A malicious user can create scripts to invoke this function indefinitely, leading to increased blockchain state bloat.

Scenario:

  1. Auction ends at timestamp X.

  2. A user calls checkAuctionEnded(), emitting AuctionEnded.

  3. Another user (or the same user) calls it again, emitting another AuctionEnded event.

  4. This continues indefinitely, causing unnecessary event emissions and gas consumption.

Impact

  • Increased blockchain state growth due to unnecessary event logs.

  • Users may unintentionally waste gas by calling the function multiple times.

  • Potential for spam-like behavior affecting chain performance.

Tools Used

Manual review.

Recommendations

Modify the function to include a state flag that ensures it can only be called once:

bool public auctionEnded;
​
function checkAuctionEnded() external {
require(block.timestamp >= state.endTime, "Auction not ended");
require(!auctionEnded, "Auction already ended");
auctionEnded = true;
emit AuctionEnded(getPrice());
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 2 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.