Open sherlock-admin3 opened 5 months ago
The protocol team fixed this issue in the following PRs/commits: https://github.com/Axis-Fi/moonraker/pull/132
The protocol team fixed this issue in the following PRs/commits: Axis-Fi/moonraker#132
Fixed Latest lotId is read before usage
The Lead Senior Watson signed off on the fix.
flacko
high
Malicious user can overtake a prefunded auction and steal the deposited funds
Summary
In the auction house whenever a new auction (lot) is created, its details are recorded at the 0th index in the
lotRouting
mapping. This allows for an attacker to create an auction right after an honest user and take over their auction, allowing them to steal funds in the case of a prefunded auction.Vulnerability Detail
When a new auction is created via AuctionHouse#auction(), it's routing details are recorded directly in storage at
lotRouting[lotId]
wherelotId
is the return value of theauction()
function itself. Since the return value is declared as a variable at the function signature level, it is initialized with the value of0
.This means that when the
routing
storage variable is declared (Routing storage routing = lotRouting[lotId];
) it will always point tolotRouting[0]
as the value oflotId
is set a bit later in theauction()
function to the correct index. This itself leads to the issue that an honest user can create a prefunded auction and an attacker can then come in, create a new auction themselves that is not prefunded and be immediately entitled to the honest user's prefunded funds by cancelling the auction they've just created as they're set as theseller
of the lot atlotRouting[0]
.This attack is also possible because the
funding
attribute of a lot is only set if an auction is specified to be prefunded in its parameters at creation.Impact
The following POC demonstrates how an attacker can overtake an honest user's auction and steal the funds they've pre-deposited. The attacker only needs to ensure the base token of the malicious auction they are creating is the same as the one of the auction of the honest user. Once that's done, the attacker only needs to cancel the auction and the funds will be transferred to them.
To run the POC just create a file
AuctionHouseTest.t.sol
somewhere under the./moonraker/test
directory, addsrc=/src/
to remappings.txt and run it usingforge test --match-test test_overtake_auction_and_steal_prefunded_funds
.Code Snippet
https://github.com/sherlock-audit/2024-03-axis-finance/blob/main/moonraker/src/bases/Auctioneer.sol#L160-L164 https://github.com/sherlock-audit/2024-03-axis-finance/blob/main/moonraker/src/bases/Auctioneer.sol#L174 https://github.com/sherlock-audit/2024-03-axis-finance/blob/main/moonraker/src/bases/Auctioneer.sol#L194 https://github.com/sherlock-audit/2024-03-axis-finance/blob/main/moonraker/src/bases/Auctioneer.sol#L211-L212
Tool used
Manual Review Foundry Forge
Recommendation