Open sherlock-admin3 opened 5 months ago
The protocol team fixed this issue in the following PRs/commits: https://github.com/Axis-Fi/moonraker/pull/105
The protocol team fixed this issue in the following PRs/commits: Axis-Fi/moonraker#105
Fixed start and conclusion timestamps of auction is now made consistent across all functions
The Lead Senior Watson signed off on the fix.
ether_sky
high
Auction creators have the ability to lock bidders' funds.
Summary
Auction creators
have the ability to cancel anauction
before it starts. However, once theauction
begins, they should not be allowed to cancel it. During theauction
,bidders
can placebids
and sendquote
tokens to theauction house
. After theauction
concludes,bidders
can either receivebase
tokens or retrieve theirquote
tokens. Unfortunately,batch auction creators
can cancel anauction
when it ends. This means thatauction creators
can cancel theirauctions
if they anticipatelosses
. This should not be allowed. The significant risk is thatbidders' funds
could become locked in theauction house
.Vulnerability Detail
Auction creators
can not cancel anauction
once it concludes.They also can not cancel it while it is active.
When the
block.timestamp
aligns with theconclusion
time of theauction
, we can bypass these checks.So
Auction creators
can cancel anauction
when it concludes. Then thecapacity
becomes0
and theauction status
transitions toClaimed
.Bidders
can notrefund
theirbids
.The only way for
bidders
to reclaim their tokens is by calling theclaimBids
function. However,bidders
can only claimbids
when theauction status
isSettled
.To
settle
theauction
, theauction status
should beDecrypted
. This requires submitting theprivate key
. Theauction creator
can not submit theprivate key
or submit it without decrypting anybids
by callingsubmitPrivateKey(lotId, privateKey, 0)
. Then nobody can decrypt thebids
using thedecryptAndSortBids
function which always reverts.As a result, the
auction status
remains unchanged, preventing it from transitioning toSettled
. This leaves thebidders'
quote
tokens locked in theauction house
.Please add below test to the
test/modules/Auction/cancel.t.sol
.The log is
Impact
Users' funds can be locked.
Code Snippet
https://github.com/sherlock-audit/2024-03-axis-finance/blob/cadf331f12b485bac184111cdc9ba1344d9fbf01/moonraker/src/modules/Auction.sol#L354 https://github.com/sherlock-audit/2024-03-axis-finance/blob/cadf331f12b485bac184111cdc9ba1344d9fbf01/moonraker/src/modules/auctions/EMPAM.sol#L204 https://github.com/sherlock-audit/2024-03-axis-finance/blob/cadf331f12b485bac184111cdc9ba1344d9fbf01/moonraker/src/modules/Auction.sol#L512 https://github.com/sherlock-audit/2024-03-axis-finance/blob/cadf331f12b485bac184111cdc9ba1344d9fbf01/moonraker/src/modules/Auction.sol#L556 https://github.com/sherlock-audit/2024-03-axis-finance/blob/cadf331f12b485bac184111cdc9ba1344d9fbf01/moonraker/src/modules/auctions/EMPAM.sol#L449
Tool used
Manual Review
Recommendation