Liquidation auction will change the auction hash after every bid. Also it does not have a limit on minBid amount. Attacker could spam placeBid() with low amount 1 wei -> 2 wei -> 3 wei and other users cannot place any bid.
Mitigation
Implemented minBid made the cost for attacker increased significantly.
Lines of code
Vulnerability details
Issue
Liquidation auction will change the auction hash after every bid. Also it does not have a limit on
minBid
amount. Attacker could spamplaceBid()
with low amount 1 wei -> 2 wei -> 3 wei and other users cannot place any bid.Mitigation
Implemented
minBid
made the cost for attacker increased significantly.