Arbitrage Opportunity for Non-Sellers

Lines of code Vulnerability details Impact Non-sellers can flood the system with arbitrage auctions. Proof of Concept The seller can wait until 1 instant minute? before the end of the auction. Now the seller places a bid a couple percent above the current market price, enough to cover the seller'...

Bidder can abuse the bidIndices[] in finalize()

Lines of code Vulnerability details Impact finalize could be called by anyone, and the input array bidIndices is not sanity checked. Some malicious bidder can trick the bidIndices to always get the reserveQuotePerBase price. The seller would incur some loss. The other bidders are grieved, wasting...

Filling all auction slots to win the auction

Lines of code Vulnerability details Vulnerability details Description The number of bids for one auction is limited to 1000. It means that someone may make all 1000 bids and thus invalidate all other bids. Therefore, a malicious user can win the auction with the minimum possible bid. It may seem...

A bidder can buy baseToken with low price by exploiting the DOS prevention measure

Lines of code Vulnerability details Impact In order to prevent DOS attacks, the smart contract introduces a measure that limits the number of bids on an auction SizeSealed.solL157-L159. However, an attacker/bidder can exploit this measure to block others to place bids so that the attacker can buy...

Seller can stole users assets by create and then cancel the auction

Lines of code Vulnerability details Impact Seller can stole users assets by create and cancel auction Proof of Concept Seller can create an auction, then wait for people to participate in auction bidding, finally the seller cancel the auction and get the users assets. This scenario can happen wit...

Cancel auction does not get deleted leading to loss of quoteTokens

Lines of code Vulnerability details Impact A malicious seller can cancel the auction just after it has ended, receive their baseToken back and then call reveal to make bidders lose their tokens which is sent to address0. Since a.data.lowestQuote == typeuint128.max just before reveal call is made,...

Seller can game the bidIndices[] in finalize()

Lines of code Vulnerability details Impact High bidders will be taken advantage of by malicious seller. It is likely that the high bidders will place bids above the market price, then the seller can effectively steal the price difference from them. And the other bidders are grieved, wasting time...

Rebasing tokens as Base tokens for the auction could be stuck in the contract or mean loss of funds for the las person to withdraw

Lines of code Vulnerability details Impact Use of rebasing tokens is not checked and could result it stuck funds, inability to cancel an Auction or withdraw due amounts of base token for the last one to call withdraw Proof of Concept If a rebasing token is used for the base token the balance held...

seller can change lowestBaseand lowestQuote and the seller can make it diffrent values causing a dos or loss of funds

Lines of code Vulnerability details Impact When I a seller finalizes the auction they change the lowestQuote and lowestBase.When users withdraw from the auction after the auction is finalized. QuoteBought is calculated with the new amounts which can cause dos or refund their leftover quote amount...

Dutch auction on-chain might work as expected

Lines of code Vulnerability details Impact Dutch auction on-chain for Page and Gobbler might work as expected. Bidders could spontaneously form some group to take advantage of the rule. The protocol will receive much less fund from auctions, effectively the auction funds being stolen. Proof of...

auction-as.ru Cross Site Scripting vulnerability OBB-2944383

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

A majority attack can easily bypass Zora auction stage in OpenseaProposal and steal the NFT from the party.

Lines of code Vulnerability details Description The PartyGovernance system has many defenses in place to protect against a majority holder stealing the NFT. One of the main protections is that before listing the NFT on Opensea for a proposal-supplied price, it must first try to be auctioned off o...

createBid call front-running

Lines of code Vulnerability details Description There is createBid function in the Auction contract. The function accept the tokenId, which does not contain any information about the token itself. As a result, transactions of users can be front-runned to enforce user make a bid for the token with...

Users can grief the auction and win it

Lines of code Vulnerability details Impact Users can grief the auction and win it anytime. Proof of Concept A malicious actor who create bids through his/her smart contract can grief the Auction.sol's createBid function. Let's say that the attacker's contract has a fallback function that griefs t...

Bids can be created while paused

Lines of code Vulnerability details createBid allows for bid creation while the Auction is paused. As the latter happens on a system error mint failure, this can allow an attacker to interacts with the malfunctioning system. This at least can lead to misallocation of user's funds, i.e. freezing t...

Use safeTransfer to send ERC721 tokens

Lines of code Vulnerability details Impact Winner of the auction can lose his NFT Proof of Concept When you settle and auction you transfer the NFT using transferFrom token.transferFromaddressthis, auction.highestBidder, auction.tokenId; Maybe this is just an intended behaviour and is the...

It is possible to add more than 15 properties

Lines of code Vulnerability details The total number of properties is now limited to be 15 or less with hard code on the storage structures level. In the same time it is possible to add unlimited number of properties with MetadataRenderer's addProperties. If this happens, with a malicious intent ...

auction-spotter.de Cross Site Scripting vulnerability OBB-2829009

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

auction-spotter.de Cross Site Scripting vulnerability OBB-2816021

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

User does not get commission

Lines of code Vulnerability details Impact If Auctioned Vault debt is cleared from external source depositing extra collateral, auction can be cancelled prematurely. In this case auctioneer loses his commission. User must be given commission once auction starts at auctionStarted. Note Also it see...