Artur - Lack of Emergency Control in Auction House Bidding Functions

[sherlock-admin3]

Artur

Medium

Lack of Emergency Control in Auction House Bidding Functions

Summary

The absence of the whenNotPaused modifier in the createBid functions will creates a vulnerability for the auction house as it allows bidding to continue even during emergencies.

Root Cause

In the NounsAuctionHouseV3 contract, the createBid functions do not implement the whenNotPaused modifier, which is essential for pausing critical functions during emergencies.

• In NounsAuctionHouseV3.sol, the createBid functions lack the whenNotPaused modifier.
  (Github Link to first function)
  (Github to second function)

function createBid(uint256 nounId) external payable override {
    createBid(nounId, 0);
}

/**
 * @notice Create a bid for a Noun, with a given amount.
 * @param nounId id of the Noun to bid on
 * @param clientId the client which facilitates this action
 * @dev This contract only accepts payment in ETH.
 */
function createBid(uint256 nounId, uint32 clientId) public payable override {
    // Function logic here
}

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

No response

Impact

The auction house suffers a complete loss of control over its bidding functionality. The absence of the whenNotPaused modifier allows:

• Bids to be placed during a known vulnerability
• The attacker to exploit the bidding process without any immediate way to halt the activity, resulting in unauthorized manipulation of auction outcomes.

PoC

No response

Mitigation

No response