Submitted by RadiantLabs
When a Dutch auction that originated from the backing manager receives a bid, it calls BackingManager.settleTrade() to settle the auction immediately, which attempts to chain into another rebalance() call. This chaining is implemented using a try-catch block that attempts to catch out-of-gas errors.
However, this pattern is not safe because empty error data does not always indicate an out-of-gas error. Other types of errors also return no data, such as calls to empty addresses casted as contracts and revert / require statements with no error message.
The rebalance() function interacts with multiple external assets and performs several operations that can throw empty errors:
If any of these operations result in an empty error, the auction settlement will fail. This can lead to the Dutch auction being unable to settle at a fair price.
Note: we have found this finding pointing out the very same issue in a previous audit, but this report highlights a different root cause in where the error originates.
Dutch auctions may fail to settle at the appropriate price or at all.
Avoid usage of this pattern to catch OOG errors in any functions that cannot revert and may interact with external contracts. Instead, in such cases always employ the _reserveGas() pattern that was iterated on to mitigate previous findings (1, 2, 3) with a similar root cause. We have found no other instances in which this applies.
akshatmittal (Reserve) disputed and commented:
EV_om (warden) commented:
cccz (judge) commented:
akshatmittal (Reserve) commented:
cccz (judge) commented:
EV_om (warden) commented:
akshatmittal (Reserve) commented:
cccz (judge) commented:
