Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

User can pass `0 amount` on `Auction::buy` which can be used in malicious way

sakibcy

Summary

User can pass 0 amount on Auction::buy which can be used in a malicious way

Vulnerability Details

On Auction::buy we can see there is no limit check for putting a bid. As a result, a user can call a huge number of time the Auction::buy function with 0 amount in and as a result cause a DOS for all.

It's not about just only DOS, see the Impact section for more details.

/**
Bid on the ZENO auction
User will able to buy ZENO tokens in exchange for USDC
*/
function buy(uint256 amount) external whenActive {
require(amount <= state.totalRemaining, "Not enough ZENO remaining");
uint256 price = getPrice();
uint256 cost = price * amount;
require(usdc.transferFrom(msg.sender, businessAddress, cost), "Transfer failed");
​
bidAmounts[msg.sender] += amount;
state.totalRemaining -= amount;
state.lastBidTime = block.timestamp;
state.lastBidder = msg.sender;
​
zeno.mint(msg.sender, amount);
emit ZENOPurchased(msg.sender, amount, price);
}

Impact

Let's say a user A puts a bid but not a that much higher bid but higher than the previous one.

And he put the bid when the auction was nearly at the endTime.

So he is willing to win this bid. But any user can come and put a higher bid than user A and win the auction.

So, the A did some tricks.

After he put his bid higher than the previous one. He create a lots on buy with 0 amount, even though he is ready to pay higher gas fee.

So he block it for any further users and gonna win the auction as the auction was nearly end time.

So he actually win the auction. But the auction owner has lose money as there was another user to put higher value than A but the another user could not do that because the auction ended.

We can also see when the auction is ended the getPrice function returns different amounts.

So the auction owner is losing here because he was willing to get as high value as possible.

Even there is a possibility for a DOS even if the malicious user has no intention of winning the auction

Tools Used

Manual

Recommendations

Add a minimum amount for Auction::buy so that even if a user calls buy for a lot of time, it will be not profitable for him. Also not a loss for the Auction owner as he gets as higher value as possible.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!