Submitted by zhaojie, also found by bin2chen
The attacker performs a DoS attack on the Bid function, causing other users to be unable to participate and eventually obtaining the NFT at a low price.
The placeBid function requires each bid to increase by 5% from the original, locking in for a period of time after each bid.
The problem here is that if the initial price increases from a very small value, the second increase in percentage only needs to be a very small amount. For example: 100 wei -> 105 wei -> 110 wei.
So an attacker can start with a small bid and keep growing slowly. Because of the time lock, other users cannot participate for a period of time. Normal users must wait until the time lock is over and the transaction needs to be executed before the attacker.
If normal users are unable to participate in the bidding, the attacker can obtain the auction item (NFT) at a very low price.
VScode
DoS
0xA5DF (judge) commented:
0xend (Gondi) confirmed and commented:
0xA5DF (judge) decreased severity to Medium and commented:
0xend (Gondi) commented:
Gondi mitigated:
Status: Mitigation confirmed. Full details in reports from oakcobalt and minhquanym.
