Submitted by minhquanym, also found by bin2chen
The function settleWithBuyout() is used to settle an auction with a buyout from the main lender. This lender needs to repay all other lenders and will receive the NFT collateral. Near the end of the function, the triggerFee is also paid to the auction originator. However, the funds used to pay this fee are taken directly from the contract balance, even though the main lender doesnt transfer these funds into the contract.
As a result, if the auction contract balance is insufficient to cover the fee, the function will simply revert and prevent the main lender from buying out. In other cases where multiple auctions are running in parallel, the triggerFee will be deducted from the other auctions. This could lead to the last auctions being unable to settle due to insufficient balance.
The function settleWithBuyout() is called before any placeBid() so the funds is only from main lender. In the settleWithBuyout(), there are 2 transfers asset. One is to pay other lenders and one is to pay the triggerFee. As you can see in the code snippet, there is no triggerFee transfer from sender to originator.
Consider using safeTransferFrom() to pay the triggerFee from the senders address, rather than using safeTransfer() to pay the triggerFee from the contract balance.
0xend (Gondi) confirmed
0xA5DF (judge) commented:
Gondi mitigated:
Status: Mitigation confirmed. Full details in reports from oakcobalt, minhquanym and bin2chen.
