Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

NFTLiquidator:placeBid() is manipulatable with multisigs or ether-reverting smart contracts

0xlrivo

Summary

NFTLiquidator:placeBid() is manipulatable with multi-signature wallets or ether-reverting smart contracts due to the usage of transfer() to refound the previously highest bidder.

Vulnerability Details

If the caller outbids the previous highest bidder, the contract refunds him using the transfer() function:

function placeBid(uint256 tokenId) external payable {
TokenData storage data = tokenData[tokenId];
if (block.timestamp >= data.auctionEndTime) revert AuctionHasEnded();
uint256 minBidAmount = data.highestBid + (data.highestBid * minBidIncreasePercentage / 100);
if (msg.value <= minBidAmount) revert BidTooLow(minBidAmount);
​
// @audit-issue multi-sig wallet can DoS the bid process and claim the NFT
// @audit-issue should anyone can bid with a smart contract that reverts on transfer
if (data.highestBidder != address(0)) {
payable(data.highestBidder).transfer(data.highestBid);
}
​
data.highestBid = msg.value;
data.highestBidder = msg.sender;
​
emit BidPlaced(tokenId, msg.sender, msg.value);
}

Impact

Multi-sig wallets or ETH-reverting smart contracts can be sure to win the auction if they become the highest bidder because subsequent refunds will revert, making impossible for anyone to outbid them.

In details:

  • if highestBidder is a multi-signature wallet, the refund will likely revert due to his receive() consuming more than 2300 gas

  • if highestBidder is a smart contract that reverts on ETH transfers, then the refund will always revert

Tools Used

  • Manual Review

Recommendations

Do such auctions with WETH, which is impossible to reject since it's an ERC20 token.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 2 months ago
Submission Judgement Published
Invalidated
Reason: Out of scope

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.