AuctionDemo opens itself several DoS attack vectors

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept The auctionDemo.auctionInfoData map holds important info on auctions, and hold this info per tokenId. Needless to say, for many auctions that may become popular and/or long running, the...

NFT Claiming Issue Due to Lacking Ownership

Lines of code Vulnerability details Impact The vulnerability in the AuctionDemo contract has a significant impact on the ability of auction winners to claim their NFTs. The root cause of the vulnerability is that the AuctionDemo contract fails to check whether it owns or has approval to transfer...

Bid's array can be overloaded with dust bids to break AuctionDemo funcionality.

Lines of code Vulnerability details Description Bids to the auction can be created using any msg.value via participateToAuction method and are stored in an array within the mapping auctionInfoData. However, all important methods claimAuction, returnHighestBid, returnHighestBidder,...

Re-enterancy in AuctionDemo contract

Lines of code Vulnerability details Impact claimAuction function of AuctionDemo contract transfers the token to highest bidder winner and the bid amount is transferred to the owner. Moreover, refund is sent to all remaining participants non-winners of the auction via call function. However, if a...

Missing highBid value update returnHighestBidder would return the wrong HighestBidder causing nft to be minted to the wrong winner

Lines of code Vulnerability details Impact returnHighestBidder is used in checking who the winner is, however the code implemented in doing this was flawed as it missed updating highBid variable for the current higest bid found so far before next iteration. Missing this would cost function to...