Highest_bidder can front-run the owner by calling settle function
Summary
Highest_bidder can front-run the owner by calling settle function
Vulnerability Detail
If the owner of the auction decide to refund the highest_bidder for any reason, the highest_bidder by listening to a mempool transaction can decide to call settle function with a higher gas fee
Impact
Owner will not be able to force the Highest_bidder to get refunded. Highest_bidder will be able to mint NFT even if the owner decide the opposite.
MyFDsYours
medium
Highest_bidder can front-run the owner by calling settle function
Summary
Highest_bidder can front-run the owner by calling settle function
Vulnerability Detail
If the owner of the auction decide to refund the highest_bidder for any reason, the highest_bidder by listening to a mempool transaction can decide to call settle function with a higher gas fee
Impact
Owner will not be able to force the Highest_bidder to get refunded. Highest_bidder will be able to mint NFT even if the owner decide the opposite.
Code Snippet
AuctionHouse.vy#L174-L213
AuctionHouse.vy#L314-L325
Tool used
Manual Review
Recommendation
Add control acces to the settle function (only the owner)
or add in the settle function a timelock to lock the function (eg. for 1 day after epoch_end) for each caller that is different to owner.
Duplicate of #81