Submitted by 0xliumin, also found by leastwood
NFTMarketReserveAuction.sol#L325-L349
NFTMarketReserveAuction.sol#L596-L599
NFT owner can permanently lock funds of bidders.
Alice (the attacker) calls createReserveAuction, and creates one like normal. let this be auction id 1.
Alice calls createReserveAuction again, before any user has placed a bid (this is easy to guarantee with a deployed attacker contract). Wed expect that Alice wouldnt be able to create another auction, but she can, because _transferToEscrow doesnt revert if theres an existing auction. let this be Auction id 2.
Since nftContractToTokenIdToAuctionId[nftContract][tokenId] will contain auction id 2, all bidders will see that auction as the one to bid on (unless they inspect contract events or data manually).
Alice can now cancel auction id 1, then cancel auction id 2, locking up the funds of the last bidder on auction id 2 forever.
Prevent NFT owners from creating multiple auctions.
NickCuso (Foundation) confirmed and commented:
