Open sherlock-admin4 opened 5 months ago
Duplicate of #18
The protocol team fixed this issue in the following PRs/commits: https://github.com/Axis-Fi/moonraker/pull/139
The protocol team fixed this issue in the following PRs/commits: Axis-Fi/moonraker#139
Fixed The claimed status is replaced with a boolean. Hence the status of a settled auction will now always remain settled
The Lead Senior Watson signed off on the fix.
ether_sky
high
Bidders can not claim their bids if the auction creator claims the proceeds.
Summary
Before the
batch auction
begins, theauction creator
shouldprefund
base
tokens to theauction house
. During theauction
,bidders
transferquote
tokens to theauction house
. After theauction
settles,Bidders
can claim theirbids
and either to receivebase
tokens orretrieve
theirquote
tokens.auction creator
can receive thequote
tokens and retrieve the remainingbase
tokens.However, if the
auction creator
claims theproceeds
,bidders
can not claim theirbids
anymore. Consequently, theirfunds
will remain locked in theauction house
.Vulnerability Detail
When the
auction creator
claimsProceeds
, theauction status
changes toClaimed
.Once the
auction status
has transitioned toClaimed
, there is indeed no way to change it back toSettled
.However,
bidders
can only claim theirbids
when theauction status
isSettled
.Please add below test to the
test/modules/auctions/claimBids.t.sol
.Impact
Users' funds could be locked.
Code Snippet
https://github.com/sherlock-audit/2024-03-axis-finance/blob/cadf331f12b485bac184111cdc9ba1344d9fbf01/moonraker/src/modules/auctions/EMPAM.sol#L846 https://github.com/sherlock-audit/2024-03-axis-finance/blob/cadf331f12b485bac184111cdc9ba1344d9fbf01/moonraker/src/modules/Auction.sol#L556
Tool used
Manual Review
Recommendation
Allow
bidders
to claim theirbids
even when theauction status
isClaimed
.