0xMosh - Auction contract could be paused maliciously !

[sherlock-admin]

0xMosh

medium

Auction contract could be paused maliciously !

Summary

Auction contract could be paused maliciously !

Vulnerability Detail

There is a function _createAuction in Auction contract.
There is a function _createAuction in Auction contract.

It consists of the following logic:

function _createAuction() private {
    try token.mint() returns (uint256 tokenId) {
        **creating of the auction for token with id equal to tokenId**
        // Pause the contract if token minting failed
    } catch Error(string memory) {
        _pause();
    }
}

According to the EIP-150 call opcode can consume as most 63/64 of parrent calls’ gas. That means token.mint() can fail since there will be no gas.

All in all, if token.mint() fail on gas and the rest gas is enough for pausing the contract by calling _pause in catch statement the contract will be paused.

Please note, that a bug can be exploitable if the token.mint() consume more than 1.500.000 of gas, because 1.500.000 / 64 > 20.000 that need to pause the contract. Also, the logic of token.mint() includes traversing the array up to 100 times, that’s heavy enough to reach 1.500.000 gas limit.

Impact

Contract can be paused by any user by passing special amount of gas for the call of settleCurrentAndCreateNewAuction (which consists of two internal calls of _settleAuction and _createAuction functions).

Code Snippet

https://github.com/sherlock-audit/2023-09-nounsbuilder/blob/main/nouns-protocol/src/auction/Auction.sol#L292

Tool used

Manual Review

Recommendation

Add a special check for upper bound of gasLeft at start of _createAuction function.

Duplicate of #243