[H01] - BidBeastsNFTMarketPlace::_payout and BidBeastsNFTMarketPlace::withdrawAllFailedCredits Lack Proper Access Controls, Enabling Complete Fund Drainage

Description

Normal Behavior

The internal BidBeastsNFTMarketPlace::_payout function handles ETH transfers during marketplace operations. When a transfer fails (e.g., recipient contract lacks a receive() or fallback() function), the failed amount is credited to failedTransferCredits[recipient]. Users can subsequently withdraw these failed credits using the external function BidBeastsNFTMarketPlace::withdrawAllFailedCredits.

The vulnerability consists of two critical flaws that compound to create a complete fund drainage exploit:

1: Inheritance-Based Credit Generation

The _payout function is marked internal rather than private, allowing malicious contracts to inherit BidBeastsNFTMarketPlace and expose the function publicly. An attacker can:

1. Deploy a contract that inherits the marketplace

2. Expose _payout through a public wrapper function

3. Call it with a rejecter contract (no receive/fallback functions) as the recipient

4. Artificially generate failed credits without participating in legitimate auctions

2: Parameter Mismatch and Missing Balance Clearing

The withdrawAllFailedCredits function contains a critical implementation error:

This implementation allows:

• Unauthorised Access: Anyone can withdraw credits belonging to any address by passing that address as _receiver

• Infinite Withdrawal: The _receiver's balance is never cleared (only msg.sender is cleared), allowing attackers to repeatedly call withdrawAllFailedCredits(_receiver) to drain all contract funds

Vulnerable Code

Risk

Likelihood: HIGH

Reason 1 - Trivial to Execute:
The attack requires only basic Solidity knowledge and can be executed with a simple malicious contract deployment. No complex preconditions or timing requirements are necessary.

Reason 2 - Always Exploitable:
The vulnerability exists from the moment the contract is deployed. Attackers can scan the blockchain for this contract pattern and execute the attack at any time, regardless of marketplace activity. The attacker has complete control over timing and amounts.

Reason 3 - Public Attack Surface:
Both the inheritance mechanism and the withdrawAllFailedCredits() function are externally accessible with no access controls, making this vulnerability immediately exploitable by any adversary.

Impact: CRITICAL

Impact 1 - Complete Fund Loss:
This vulnerability guarantees attackers can drain 100% of the contract's ETH balance through the following mechanisms:

1. Attackers can create arbitrary failed credits at will through inheritance

2. No legitimate auction activity is required (assuming funds exist in the contract)

3. The infinite withdrawal bug enables complete drainage through repeated calls

4. All bidder deposits, pending seller payments, and protocol fees can be stolen

Impact 2 - Protocol Destruction:
Beyond immediate financial losses, this vulnerability would:

• Destroy all user trust in the marketplace

• Result in complete loss of business reputation

• Potentially lead to legal liability for user fund losses

• Likely cause the protocol to cease operations entirely

Proof of Concept

Attack Flow:

Since _payout is marked internal, it can be inherited and exploited by a malicious contract:

1. Attacker deploys a contract that inherits BidBeastsNFTMarketPlace

2. The malicious contract exposes a public function that calls the inherited _payout

3. Attacker calls this function with a rejecter contract as the recipient

4. Failed credits accumulate in failedTransferCredits[rejecterContract]

5. Attacker (using any address) repeatedly calls withdrawAllFailedCredits(rejecterContract) as msg.sender

6. All contract funds are drained

Test Instructions:

Copy the code below into a new Solidity file called MyBidBeastTests.t.sol in the test folder, then run:

Test Code:

Recommended Mitigation

1: Prevent Inheritance-Based Exploitation:

Change the _payout function visibility from internal to private to prevent malicious contracts from inheriting and exposing it:

2: Implement Proper Access Control for Withdrawals:

Remove the _receiver parameter and ensure users can only withdraw their own credits. This fixes both the unauthorized access and the infinite withdrawal bugs: