Open code423n4 opened 2 years ago
By adding a malicious token as bounty, we can make the settleAuction
transaction revert.
Simple mitigation is to not claim that bounty.
Generally speaking this can be viewed as medium severity because it's dependent on an external condition. But personally I think mitigation and likelihood are so low that I'll downgrade to low.
Will mark as low, because all it takes to avoid this type of griefing is to remove the bounty from the list, the fact that the frontend may not has no relevance for this contest
Handle
WatchPug
Vulnerability details
https://github.com/code-423n4/2021-09-defiProtocol/blob/main/contracts/contracts/Auction.sol#L102
Anyone can call
addBounty()
to add a bounty with any token. If we assume that the frontend will always pass all thebountyIDs
of active bounties tosettleAuction()
, then a malicious user can disruptsettleAuction()
byaddBounty
with a fake token that always reverts when callingtransfer()
.Impact
Auction bonder wont be able to
settleAuction()
. The malicious user and all other holders of the basket token can belifits from the burn of the auction bond.Proof of Concept
transfer()
;addBounty
with the fake token and any amount;settleAuction
withbountyIDs
including the fake token bounty will always fail.Recommended Mitigation Steps
Whitelist bounty tokens in smart contract or frontend.