parzival - Any non-minter address can pause the contract causing DOS for sometime (until unpaused by admin)

[sherlock-admin2]

parzival

Medium

Any non-minter address can pause the contract causing DOS for sometime (until unpaused by admin)

Summary

The settleCurrentAndCreateNewAuction function allows anyone to settle an active auction and then create a new one. While creating a new auction using _createAuction method; it mints a noun for the caller. The function mint is present inside NounsToken.sol which only allows a minter address to mint a noun. A non-minter address will cause a revert which will be caught by the catch inside _createAuction() and then it pauses the contract by calling the internal method _pause.

Root Cause

Reference: https://github.com/sherlock-audit/2024-11-nounsdao/blob/8b6fb94f103134e751cf016e5c3f4185be89bb49/nouns-monorepo/packages/nouns-contracts/contracts/NounsAuctionHouseV3.sol#L315

The root cause is obviously the catch body which calls the internal method _pause and pauses the contract. This is an unnecessary headache for the owner as every time some non-minter pauses the contract, the owner has to manually call the unpause method.

Internal pre-conditions

1. The caller should not be a valid minter.

External pre-conditions

No response

Attack Path

1. The non-minter address calls the settleCurrentAndCreateNewAuction function.

Impact

The protocol will suffer from random arbitrary pauses which will prevent other user to bid on auctions and create auctions too.

PoC

No response

Mitigation

Remove the pause from the catch body.