juanxavier / 2022-09-nouns-builder Goto Github PK

No proof for _vetoer zero address

/// @dev Indicates a function has not been entered
uint256 internal constant _NOT_ENTERED = 1;

/// @dev Indicates a function has been entered
uint256 internal constant _ENTERED = 2;

this can be defined as a bool, and store only 1 byte of data instead of 64 ( 2 32-byte slots)

Location: Auction.sol
Type: Improper access control and possible denial of service
Description: The settleCurrentAndCreateNewAuction() can be accessed by any user. This means that if the following statement is false: if (_auction.highestBidder != address(0)) , then any malicious user could burn the token, when the _settleAuction() is called; and when it reaches _**createAuction()**, it will try to mint the new token on line 206, but since the attacker address won't the minter address (hopefully), the contract will be paused and deny service for the protocol, at least momentarily.
Severity: 🟤 Medium
Recommendation: Make sure only the bidder, or the contract owner can settle the current bid.