Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Potential Denial of Service via Malicious Small Purchases in `buy` Function of Auction.sol

johny7173

Summary

The buy function in the Auction.sol contract allows users to purchase tokens, but it contains a vulnerability that can lead to a potential denial of service (DoS) attack. Specifically, a malicious actor can exploit this by buying a very small amount (e.g., 1 wei) of tokens before a legitimate user's transaction to buy all the remaining amount gets through.

Vulnerability Details

The vulnerability arises from the check:

require(amount <= state.totalRemaining, "Not enough ZENO remaining");

While this ensures that a user cannot buy more than the available tokens, it can also be used maliciously to prevent legitimate users to buy the remaining amount of ZENO tokens.

Impact

This issue could result in a denial of service for legitimate buyers. This would undermine the auction's purpose, causing failed transaction for legitimate buyers.

Tools Used

Manual Code Review

Recommended Mitigation

To resolve this issue, the buy function should be modified so that it automatically changes the amount to state.totalRemaining. Specifically, if a user attempts to purchase more than the total remaining tokens, they should instead be allowed to buy the remaining amount. This can be achieved by adjusting the amount to match the state.totalRemaining if the requested amount exceeds the available tokens.

Suggested change to the buy function:

function buy(uint256 amount) external whenActive {
+ if (amount > state.totalRemaining) {
+ amount = state.totalRemaining;
+ }
- require(amount <= state.totalRemaining, "Not enough ZENO remaining");
uint256 price = getPrice();
uint256 cost = price * amount;
require(usdc.transferFrom(msg.sender, businessAddress, cost), "Transfer failed");
​
bidAmounts[msg.sender] += amount;
state.totalRemaining -= amount;
state.lastBidTime = block.timestamp;
state.lastBidder = msg.sender;
​
zeno.mint(msg.sender, amount);
emit ZENOPurchased(msg.sender, amount, price);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.