Submitted by ronnyx2017
The createAuction function lacks the check of re-entrancy. An attacker can use an ERC777 token with tax as the base token to create auctions. By registering ERC777TokensSender interface implementer in the ERC1820Registry contract, the attacker can re-enter the createAuction function and create more than one auction with less token. And the sum of the totalBaseAmount of these auctions will be greater than the token amount received by the SizeSealed contract. Finally, the attacker can take more money from the contract global pool which means stealing tokens from the other auctions and treasury.
Forge test
You should fork mainnet because the test needs to call the ERC1820Registry contract at 0x1820a4B7618BdE71Dce8cdc73aAB6C95905faD24
Test passed and print logs:
foundry
check re-entrancy
Trust (warden) commented:
RagePit (SIZE) confirmed
ronnyx2017 (warden) commented:
