M-19 MitigationConfirmed

[c4-bot-2]

Lines of code

Vulnerability details

C4 Issue

M-19: Bidders might lose funds due to possible racing condition between settleWithBuyout and placeBid

Comments

Original vulnerabilities/impacts:
The vulnerability is both settleWithBuyout() and _placeBidChecks() allow the same timestamp (
_auction.startTime + _timeForMainLenderToBuy== block.timestamp). This encourages tx racing. The impact is when a user’s placeBid settles before settleWithBuyout(), the user will lose their bid funds, because settleWithBuyout will delete the auction data and transfer out collateral NFT tokens.

Mitigation

Fix: https://github.com/pixeldaogg/florida-contracts/pull/392/files

//src/lib/AuctionWithBuyoutLoanLiquidator.sol
    function settleWithBuyout(
        address _nftAddress,
        uint256 _tokenId,
        Auction calldata _auction,
        IMultiSourceLoan.Loan calldata _loan
    ) external nonReentrant {
...
        if (timeLimit <= block.timestamp) {
            revert OptionToBuyExpiredError(timeLimit);
        }
...

The mitigation is to separate the time window between settleWithBuyout() and _placeBidChecks(). In settleWithBuyou(), the check now will revert if timeLimit == block.timestamp.

The mitigation eliminates the attack vector and resolves the issue.

Conclusion

LGTM

[c4-judge]

alex-ppg marked the issue as satisfactory

[c4-judge]

alex-ppg marked the issue as confirmed for report