kutugu - Malicious pausing auction attack

[sherlock-admin2]

kutugu

medium

Malicious pausing auction attack

Summary

The third party can control the gas and cause the external call of the contract to fail, but the remaining 1 / 64 gas can still execute the subsequent logic try/catch normally, causing problems in the pause logic.

Vulnerability Detail

This issue involves the fix from the previous review, refer to: M-12、M-15.
The main problem has been detailed in M-15, but due to intentional design, the previous contract would not catch OOG errors, but the fix in M-12 will now catch OOG errors.
Therefore, a malicious attacker can use a carefully designed gas amount to maliciously suspend the contract operation.

Impact

The contract was maliciously suspended and had to wait for the owner to unpause and mint coins.

Code Snippet

• https://github.com/sherlock-audit/2023-09-nounsbuilder/blob/db232c649b425c36f5a93607c95cfdf0e5962b2f/nouns-protocol/src/auction/Auction.sol#L324-L328

Tool used

Manual Review

Recommendation

Check gas limits or handle different errors differently

Duplicate of #243