Malicious seller can steal from bidders.

Lines of code Vulnerability details Impact A seller can cancel the auction after finalize and thus can steal money from the bidders and get their original baseToken back. POC When an auction is started the value of a.data.lowestQuote is set as typeuint128.max here . In the atState function this...

Attacker can steal any funds in the contract by state confusion (no preconditions)

Lines of code Vulnerability details HIGH: Attacker can steal any funds in the contract by state confusion no preconditions LOC: Description Auctions in SIZE can be in one of several states, as checked in the atState modifier: modifier atStateAuction storage a, States state if block.timestamp...

Bidder can abuse the bidIndices[] in finalize()

Lines of code Vulnerability details Impact finalize could be called by anyone, and the input array bidIndices is not sanity checked. Some malicious bidder can trick the bidIndices to always get the reserveQuotePerBase price. The seller would incur some loss. The other bidders are grieved, wasting...

Denial of service when baseAmount is equal to zero

Lines of code Vulnerability details Vulnerability details Description There is a finalize function in the SizeSealed smart contract. The function traverses the array of the bids sorted by price descending. On each iteration, it calculates the quotePerBase. When this variable is calculated, the...

A bidder can buy baseToken with low price by exploiting the DOS prevention measure

Lines of code Vulnerability details Impact In order to prevent DOS attacks, the smart contract introduces a measure that limits the number of bids on an auction SizeSealed.solL157-L159. However, an attacker/bidder can exploit this measure to block others to place bids so that the attacker can buy...

Rebasing tokens as Base tokens for the auction could be stuck in the contract or mean loss of funds for the las person to withdraw

Lines of code Vulnerability details Impact Use of rebasing tokens is not checked and could result it stuck funds, inability to cancel an Auction or withdraw due amounts of base token for the last one to call withdraw Proof of Concept If a rebasing token is used for the base token the balance held...

seller can change lowestBaseand lowestQuote and the seller can make it diffrent values causing a dos or loss of funds

Lines of code Vulnerability details Impact When I a seller finalizes the auction they change the lowestQuote and lowestBase.When users withdraw from the auction after the auction is finalized. QuoteBought is calculated with the new amounts which can cause dos or refund their leftover quote amount...

Providing the same address for the "base" and the "quote" tokens creates a risk of fund loss for the seller.

Lines of code Vulnerability details Impact The "createAuction" function requires the seller to input the address of a base and a quote token. However, there is no statement that checks whether or not these two provided addresses are the same. As a result, the seller could accidentally fill in an...

Bid can be cancelled after being finalized

Lines of code Vulnerability details Impact The SizeSealed contract's cancelBid function can be called after auction has been finalized, thereby allowing the bidder to withdraw their quoteToken after bid is finalized This is possible by bypassing the if a.data.lowestQuote != typeuint128.max ||...

Dutch auction on-chain might work as expected

Lines of code Vulnerability details Impact Dutch auction on-chain for Page and Gobbler might work as expected. Bidders could spontaneously form some group to take advantage of the rule. The protocol will receive much less fund from auctions, effectively the auction funds being stolen. Proof of...

auction-as.ru Cross Site Scripting vulnerability OBB-2944383

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

A majority attack can easily bypass Zora auction stage in OpenseaProposal and steal the NFT from the party.

Lines of code Vulnerability details Description The PartyGovernance system has many defenses in place to protect against a majority holder stealing the NFT. One of the main protections is that before listing the NFT on Opensea for a proposal-supplied price, it must first try to be auctioned off o...

Use safeTransfer to send ERC721 tokens

Lines of code Vulnerability details Impact Winner of the auction can lose his NFT Proof of Concept When you settle and auction you transfer the NFT using transferFrom token.transferFromaddressthis, auction.highestBidder, auction.tokenId; Maybe this is just an intended behaviour and is the...

Bids can be created while paused

Lines of code Vulnerability details createBid allows for bid creation while the Auction is paused. As the latter happens on a system error mint failure, this can allow an attacker to interacts with the malfunctioning system. This at least can lead to misallocation of user's funds, i.e. freezing t...

It is possible to add more than 15 properties

Lines of code Vulnerability details The total number of properties is now limited to be 15 or less with hard code on the storage structures level. In the same time it is possible to add unlimited number of properties with MetadataRenderer's addProperties. If this happens, with a malicious intent ...

Users can grief the auction and win it

Lines of code Vulnerability details Impact Users can grief the auction and win it anytime. Proof of Concept A malicious actor who create bids through his/her smart contract can grief the Auction.sol's createBid function. Let's say that the attacker's contract has a fallback function that griefs t...

createBid call front-running

Lines of code Vulnerability details Description There is createBid function in the Auction contract. The function accept the tokenId, which does not contain any information about the token itself. As a result, transactions of users can be front-runned to enforce user make a bid for the token with...

auction-spotter.de Cross Site Scripting vulnerability OBB-2829009

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

auction-spotter.de Cross Site Scripting vulnerability OBB-2816021

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Vault owners can grief auctioneers by cancelling auctions

Lines of code Vulnerability details Since auctioneers are only paid keeper incentives on successful bids, a malicious vault owner can grief auctioneers by creating a risky vault, luring an auctioneer to start an auction, and then immediately canceling it. This is a somewhat elaborate and risky...