The liquidation auction doesn't allow bidders to specify maximum bid price

[DanailYordanov]

Impact

Severity: High Likelihood: Low

Context

AuctionManager::bid()

Description

AuctionManager::bid() doesn't allow the liquidator to specify a max price they are willing to pay for the collateral they are liquidating. On the surface, this doesn't seem like an issue because the price is always decreasing due to the Dutch auction. However, this can be problematic if the chain the contracts are deployed on suffers a reorg attack. This can place the transaction earlier than anticipated and therefore charge the user more than they meant to pay. While this scenario is unlikely on Ethereum, the protocol is intended to be deployed on Arbitrum, which is more susceptible to reorganization.

Recommendation

- function bid(uint256 _auctionId) external nonReentrant {
+ function bid(uint256 _auctionId, uint256 _maxBid) external nonReentrant {
    /* code */

    uint256 _debtToAuctionAtCurrentTime = _highestDebtToAuction -
        ((_highestDebtToAuction - _lowestDebtToAuction) *
            (block.timestamp - _auction.auctionStartTime)) /
        auctionDuration;

+   require(_debtToAuctionAtCurrentTime <= _maxBid, 'max-bid-exceeded');

    /* code */