Filling all auction slots to win the auction

Lines of code Vulnerability details Vulnerability details Description The number of bids for one auction is limited to 1000. It means that someone may make all 1000 bids and thus invalidate all other bids. Therefore, a malicious user can win the auction with the minimum possible bid. It may seem...

Auction can be DoS-ed with too many bids

Lines of code Vulnerability details Proof of Concept The bid functionality pushes every new bid to the a.bids array. On finalize this array is looped over. Now, if there are too many bids in it, the for loop gas consumption will go over the block gas limit, which is 30M gas units currently. The...

Attacker can drain the SizeSealed.sol contract.

Lines of code Vulnerability details Impact An attacker can drain the SizeSealed.sol contract buy creating fake auction and manipulating some contract logic. POC Assuming that the SizeSealed.sol initially contains 10000 DAI tokens, I’ll demonstrate how an attacker can steal these tokens. The bug i...

Seller can stole users assets by create and then cancel the auction

Lines of code Vulnerability details Impact Seller can stole users assets by create and cancel auction Proof of Concept Seller can create an auction, then wait for people to participate in auction bidding, finally the seller cancel the auction and get the users assets. This scenario can happen wit...

Attacker can steal any funds in the contract by state confusion (no preconditions)

Lines of code Vulnerability details HIGH: Attacker can steal any funds in the contract by state confusion no preconditions LOC: Description Auctions in SIZE can be in one of several states, as checked in the atState modifier: modifier atStateAuction storage a, States state if block.timestamp...

A bidder can buy baseToken with low price by exploiting the DOS prevention measure

Lines of code Vulnerability details Impact In order to prevent DOS attacks, the smart contract introduces a measure that limits the number of bids on an auction SizeSealed.solL157-L159. However, an attacker/bidder can exploit this measure to block others to place bids so that the attacker can buy...

Denial of service when baseAmount is equal to zero

Lines of code Vulnerability details Vulnerability details Description There is a finalize function in the SizeSealed smart contract. The function traverses the array of the bids sorted by price descending. On each iteration, it calculates the quotePerBase. When this variable is calculated, the...

Malicious seller can steal from bidders.

Lines of code Vulnerability details Impact A seller can cancel the auction after finalize and thus can steal money from the bidders and get their original baseToken back. POC When an auction is started the value of a.data.lowestQuote is set as typeuint128.max here . In the atState function this...

Bidder can abuse the bidIndices[] in finalize()

Lines of code Vulnerability details Impact finalize could be called by anyone, and the input array bidIndices is not sanity checked. Some malicious bidder can trick the bidIndices to always get the reserveQuotePerBase price. The seller would incur some loss. The other bidders are grieved, wasting...

seller can change lowestBaseand lowestQuote and the seller can make it diffrent values causing a dos or loss of funds

Lines of code Vulnerability details Impact When I a seller finalizes the auction they change the lowestQuote and lowestBase.When users withdraw from the auction after the auction is finalized. QuoteBought is calculated with the new amounts which can cause dos or refund their leftover quote amount...

Rebasing tokens as Base tokens for the auction could be stuck in the contract or mean loss of funds for the las person to withdraw

Lines of code Vulnerability details Impact Use of rebasing tokens is not checked and could result it stuck funds, inability to cancel an Auction or withdraw due amounts of base token for the last one to call withdraw Proof of Concept If a rebasing token is used for the base token the balance held...

Bid can be cancelled after being finalized

Lines of code Vulnerability details Impact The SizeSealed contract's cancelBid function can be called after auction has been finalized, thereby allowing the bidder to withdraw their quoteToken after bid is finalized This is possible by bypassing the if a.data.lowestQuote != typeuint128.max ||...

Providing the same address for the "base" and the "quote" tokens creates a risk of fund loss for the seller.

Lines of code Vulnerability details Impact The "createAuction" function requires the seller to input the address of a base and a quote token. However, there is no statement that checks whether or not these two provided addresses are the same. As a result, the seller could accidentally fill in an...

Dutch auction on-chain might work as expected

Lines of code Vulnerability details Impact Dutch auction on-chain for Page and Gobbler might work as expected. Bidders could spontaneously form some group to take advantage of the rule. The protocol will receive much less fund from auctions, effectively the auction funds being stolen. Proof of...

auction-as.ru Cross Site Scripting vulnerability OBB-2944383

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

A majority attack can easily bypass Zora auction stage in OpenseaProposal and steal the NFT from the party.

Lines of code Vulnerability details Description The PartyGovernance system has many defenses in place to protect against a majority holder stealing the NFT. One of the main protections is that before listing the NFT on Opensea for a proposal-supplied price, it must first try to be auctioned off o...

Use safeTransfer to send ERC721 tokens

Lines of code Vulnerability details Impact Winner of the auction can lose his NFT Proof of Concept When you settle and auction you transfer the NFT using transferFrom token.transferFromaddressthis, auction.highestBidder, auction.tokenId; Maybe this is just an intended behaviour and is the...

Bids can be created while paused

Lines of code Vulnerability details createBid allows for bid creation while the Auction is paused. As the latter happens on a system error mint failure, this can allow an attacker to interacts with the malfunctioning system. This at least can lead to misallocation of user's funds, i.e. freezing t...

It is possible to add more than 15 properties

Lines of code Vulnerability details The total number of properties is now limited to be 15 or less with hard code on the storage structures level. In the same time it is possible to add unlimited number of properties with MetadataRenderer's addProperties. If this happens, with a malicious intent ...

createBid call front-running

Lines of code Vulnerability details Description There is createBid function in the Auction contract. The function accept the tokenId, which does not contain any information about the token itself. As a result, transactions of users can be front-runned to enforce user make a bid for the token with...