Seller has no commitment and could use the system to create griefing attacks

[code423n4]

Lines of code

https://github.com/code-423n4/2022-11-size/blob/79aa9c01987e57a760521acecfe81b28eab3b313/src/SizeSealed.sol#L409 https://github.com/code-423n4/2022-11-size/blob/79aa9c01987e57a760521acecfe81b28eab3b313/src/SizeSealed.sol#L99

Vulnerability details

Impact

Creating an auction and cancelling it later in time is free - aside gas costs. It is therefore super easy to use the system to grief bidders, and it is may lead to irresponsible behaviors on the seller side.

Proof of Concept

Currently there is no penalty for creating an auction and cancelling it later in time. Although it's totally understandable to give the possibility to sellers to change their mind, it shouldn't be free:

• bidders paid gas cost to call bid
• bidders had to freeze some funds during the process to call bid

Therefore it should at least cost something to the seller to cancel its auction, especially to ensure no one uses the system to create griefing attacks.

Recommended Mitigation Steps

Add a small cancelation fee to make the system more fair and mitigate the griefing attack possibility.

[c4-judge]

0xean marked the issue as duplicate

[c4-judge]

0xean marked the issue as satisfactory

[c4-judge]

Duplicate of https://github.com/code-423n4/2022-11-size-findings/issues/119