psb01 - Existing owner of token or initial bidder can not place bid

[sherlock-admin2]

psb01

medium

Existing owner of token or initial bidder can not place bid

Summary

Existing owner of token or initial bidder can not place bid.

Vulnerability Detail

Inside EnglishPeriodicAuctionInternal.sol , Here in function _placeBid In the below code If bidder is currentBidder then feeAmount will be equal to total Collateral Amount. if (bidder == currentBidder) { // If current bidder, collateral is entire fee amount feeAmount = totalCollateralAmount; }

but here In the below code this check ensure that the calculated fee amount (which is calculated based on given bidAmount) is equal to the given 'feeAmount'. i.e calculatedFeeAmount == feeAmount. require( _checkBidAmount(bidAmount, feeAmount), 'EnglishPeriodicAuction: Incorrect bid amount' );

Below is function _checkBidAmount. function _checkBidAmount( uint256 bidAmount, uint256 feeAmount ) internal view returns (bool) { uint256 calculatedFeeAmount = _calculateFeeFromBid(bidAmount); return calculatedFeeAmount == feeAmount; }

and This is the code for calculation of fee from bidAmount function _calculateFeeFromBid( uint256 bidAmount ) internal view returns (uint256) { uint256 feeNumerator = IPeriodicPCOParamsReadable(address(this)) .feeNumerator(); uint256 feeDenominator = IPeriodicPCOParamsReadable(address(this)) .feeDenominator(); return (bidAmount * feeNumerator) / feeDenominator; }

As In this case when bidder is currentBidder feeAmount = totalCollateralAmount which would be higher than the calculatedFeeAmount so this check require(` `_checkBidAmount(bidAmount, feeAmount),` `'EnglishPeriodicAuction: Incorrect bid amount'` `); will always revert and bid will not be placed.

Impact

If owner of token or initial bidder want to place bid in auction to reclaim the token then bid will not be placed.

Code Snippet

https://github.com/sherlock-audit/2024-02-radicalxchange/blob/main/pco-art/contracts/auction/EnglishPeriodicAuctionInternal.sol#L319-L340

Tool used

Manual Review

Recommendation

Apply this check _checkBidAmount() only for bidders who are not currentBidder.