Skip to content

Latest commit

 

History

History
46 lines (26 loc) · 2.22 KB

051.md

File metadata and controls

46 lines (26 loc) · 2.22 KB

Elegant Arctic Stork

Medium

Deleting the Last Auction Causes Index Mapping Errors

Summary

A lack of conditional handling when deleting the last auction in allActiveAuctionOrders will cause an array misalignment and incorrect index mapping for both AuctionOrderIndex and allActiveAuctionOrders, as the auction deletion logic inadvertently overwrites entries and creates stale mappings.

Root Cause

In AuctionFactory.sol:_deleteAuctionOrder, the function lacks handling for cases where the auction to be deleted is the last one in allActiveAuctionOrders. This results in overwriting the last entry with itself, creating an unnecessary address(0) entry without effectively removing it.

https://github.com/sherlock-audit/2024-11-debita-finance-v3/blob/main/Debita-V3-Contracts/contracts/auctions/AuctionFactory.sol#L145-L160

Internal pre-conditions

  1. activeOrdersCount must be at least 1.
  2. The auction to be deleted is the last one in the allActiveAuctionOrders list (index == activeOrdersCount - 1).

External pre-conditions

None.

Attack Path

  1. An auction reaches its end and calls _deleteAuctionOrder.
  2. The _deleteAuctionOrder function attempts to delete an auction at the last index of allActiveAuctionOrders.
  3. The function inadvertently overwrites allActiveAuctionOrders[activeOrdersCount - 1] with address(0), leaving a stale entry.
  4. The AuctionOrderIndex mapping is updated incorrectly, creating potential misalignments in future order retrievals.

Impact

The protocol will have inconsistent data within the allActiveAuctionOrders and AuctionOrderIndex mappings, potentially leading to incorrect data reads, disrupted user experience, and possible failures in auction-related functionalities. Future interactions with the auction orders could be affected due to stale or erroneous mappings, causing potential financial or operational disruption.

PoC

N/A

Mitigation

To handle the deletion of the last auction order correctly, you could add a conditional check to handle cases where index == activeOrdersCount - 1. If it is the last auction:

  • Simply set AuctionOrderIndex[_AuctionOrder] to 0 without swapping or overwriting.
  • Reduce activeOrdersCount directly without modifying allActiveAuctionOrders.