Submission Details
Severity:
It is possible to buy ZENO outside of auction start and end time
Summary
It is possible to buy ZENO outside of auction start and end time.
Vulnerability details
The Auction contract allows set-up auctions to sell ZENO at a decreasing price.
The AuctionState state has a startTime and endTime parameter, but these parameters are never checked during a purchase through buy().
There is even a checkAuctionEnded() function, showing that it shouldn't be possible to buy after endTime, but its never used.
Impact
Auction time bounds are not respected.
Proof of Concept
Recommended Mitigation Steps
Add checks for time auction boundaries.
Updates
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.