Submitted by ladboy233, also found by rvierdiiev
https://github.com/code-423n4/2023-01-astaria/blob/1bfc58b42109b839528ab1c21dc9803d663df898/src/ClearingHouse.sol#L169
https://github.com/code-423n4/2023-01-astaria/blob/1bfc58b42109b839528ab1c21dc9803d663df898/src/ClearingHouse.sol#L123
The function ClearingHouse#safeTransferFrom is meant to settle the auction but the function severely lack of access control.
which calls:
We can look into the liquidation flow:
First, the liquidate function is called in AstariaRouter.sol
Then function auctionVault is called in CollateralToken
The function _generateValidOrderParameters is important:
Note the first consideration item:
Prices[0] is the initialLiquidationPrice the starting price, prices[1] is the ending price, which is 1000 WEI. This means if no one buys the dutch auction, the price will fall to 1000 WEI.
In the code above, note that the code checks if the current balance of the payment token is larger than currentOfferPrice computed by _locateCurrentAmount, this utility function comes from seaport.
https://github.com/ProjectOpenSea/seaport/blob/f402dac8b3faabdb8420d31d46759f47c9d74b7d/contracts/lib/AmountDeriver.sol#L38
If no one buys the dutch auction, the price will drop to until 1000 WEI, which means _locateCurrentAmount returns lower and lower price.
In normal flow, if no one buys the dutch auction and covers the outstanding debt, the NFT can be claimabled by liquidator. The liquidator can try to sell NFT again to cover the debt and loss for lenders.
However, if no one wants to buy the dutch auction and the _locateCurrentAmount is low enough, for example, 10000 WEI, an adversary can transfer 10001 WEI of ERC20 payment token to the ClearingHouse contract.
Then call safeTransferFrom to settle the auction.
The code below will execute
Because the airdropped ERC20 balance make the payment larger than currentOfferPrice.
In this case, the adversary blocks the liquidator from claiming the not-auctioned liquidated NFT.
The low amount of payment 10001 WEI is not likely to cover the outstanding debt and the lender has to bear the loss.
We recommend the protocol validate the caller of the safeTransferFrom in ClearingHouse is the seaport / conduict contract and check that when the auction is settled, the NFT ownership changed and the Astaria contract does not hold the NFT any more.
