Core Contracts

Summary

The Auction contract's buy function lacks slippage protection, making it vulnerable to frontrunning attacks where users could be forced to pay higher prices than intended due to price fluctuations between transaction submission and execution.

Vulnerability Details

The price calculation in the Auction contract is time-dependent, making it predictable and manipulatable. Without slippage protection, users have no way to specify their maximum acceptable price.

Attack flow:

1. User submits transaction to buy ZENO at current price (e.g., 100 USDC)

2. Attacker identifies pending transaction in mempool

3. Attacker waits for time-based price increase

4. Original transaction executes at higher price than user intended

Impact

• Financial loss for users who pay more than intended

• Poor user experience and loss of trust in the protocol

• Potential for market manipulation by sophisticated actors

• Severity: Medium

• Likelihood: High

Recommendations

1. Immediate fixes:

   function buy(uint256 amount, uint256 maxPrice) external whenActive {

   uint256 price = getPrice();

   require(price <= maxPrice, "Price exceeds maximum");

   // ... continue with purchase ...

   }

2. Additional improvements:

   • Implement minimum time windows between price updates

   • Add price oracles for more reliable pricing

   • Implement commit-reveal schemes for critical operations

   • Add explicit documentation about slippage protection usage

   • Include events for monitoring failed transactions due to price protection