Submitted by V_B
Auction.sol#L204
Auction.sol#L206
Auction.sol#L235
There is a function _createAuction in Auction contract.
It consists of the following logic:
According to the EIP-150 call opcode can consume as most 63/64 of parrent calls gas. That means token.mint() can fail since there will be no gas.
All in all, if token.mint() fail on gas and the rest gas is enough for pausing the contract by calling _pause in catch statement the contract will be paused.
Please note, that a bug can be exploitable if the token.mint() consume more than 1.500.000 of gas, because 1.500.000 / 64 > 20.000 that need to pause the contract. Also, the logic of token.mint() includes traversing the array up to 100 times, thats heavy enough to reach 1.500.000 gas limit.
Contract can be paused by any user by passing special amount of gas for the call of settleCurrentAndCreateNewAuction (which consists of two internal calls of _settleAuction and _createAuction functions).
Add a special check for upper bound of gasLeft at start of _createAuction function.
Alex the Entreprenerd (judge) decreased severity to Medium and commented:
Alex the Entreprenerd (judge) commented:
iainnash (Nouns Builder) confirmed
