Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Lack of Minimum Bid Size in Auction Contract

bryanconquer

Summary

The auction contract does not enforce a minimum bid size, allowing users (or bots) to purchase tiny amounts of ZENO repeatedly. This creates inefficiencies and opens the door to potential exploitation:

  1. Gas Inefficiency:

    • Users making multiple small purchases pay excessive gas fees.

    • Example: Buying 1 ZENO 100 times costs significantly more gas than a single purchase of 100 ZENO.

  2. Bot Manipulation Risks:

    • Bots can spam small bids to delay auctions or front-run legitimate buyers.

    • By repeatedly placing tiny bids, bots can artificially slow down or block other bidders.

    • The contract calculates price dynamically based on time:

Recommendations

Implement a Minimum Bid Size (lotSize)

uint256 public constant minBidSize = 10 * 1e18; // 10 ZENO minimum
​
function buy(uint256 amount) external whenActive {
require(amount >= minBidSize, "Bid too small");
require(amount <= state.totalRemaining, "Not enough ZENO remaining");
uint256 price = getPrice();
uint256 cost = price * amount;
require(usdc.transferFrom(msg.sender, businessAddress, cost), "Transfer failed");
​
bidAmounts[msg.sender] += amount;
state.totalRemaining -= amount;
state.lastBidTime = block.timestamp;
state.lastBidder = msg.sender;
​
zeno.mint(msg.sender, amount);
emit ZENOPurchased(msg.sender, amount, price);
}
​
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.