code423n4 commented 3 years ago

Handle

leastwood

Vulnerability details

Impact

There are no assertions that _startPrice and _minimumPrice are significantly greater than the time difference used to calculate DutchAuction.priceDrop(). As a result, it is possible for values to be heavily truncated, leading to an incorrect priceDiff and resulting _currentPrice().

Proof of Concept

https://github.com/sushiswap/miso/blob/master/contracts/Auctions/DutchAuction.sol#L325-L332 https://github.com/sushiswap/miso/blob/master/contracts/Auctions/DutchAuction.sol#L415-L418

Tools Used

Manual code review

Recommended Mitigation Steps

Consider enforcing a minimum amount difference between _startPrice and _minimumPrice in DutchAuction.initAuction().

Clearwood commented 2 years ago

@leastwood If the values are reasonable, does it lead to any exploitable behavior? or does it just turn the DutchAuction into a crowdsale