089.md

Soft White Peacock

Medium

Limited minBidIncrementPercentage in NounsAuctionHouseV2 and NounsAuctionHouseV3 contracts

Summary

The NounsAuctionHouseV2 and NounsAuctionHouseV3 contracts have a limitation on the maximum bid increment percentage due to the use of uint8 for the minBidIncrementPercentage variable. This restricts the maximum allowable increase in bids to 255%, limiting auction flexibility.

The NounsAuctionHouseV2::setMinBidIncrementPercentage and NounsAuctionHouseV3::setMinBidIncrementPercentage functions allow setting the minimum bid increment percentage. However, the minBidIncrementPercentage variable is defined as uint8, which can only store values between 0 and 255. This means that the max minimum percentage difference between the last bid amount and the current bid that can be set is 255 (current bid max = last bid amount * 2.55).

Root Cause

In NounsAuctionHouseV2.sol:64 the minBidIncrementPercentage is defined as uint8

In NounsAuctionHouseV3.sol:65 the minBidIncrementPercentage is defined as uint8

Vulnerability

@> uint8 public minBidIncrementPercentage;

@> function setMinBidIncrementPercentage(uint8 _minBidIncrementPercentage) external override onlyOwner {
        require(_minBidIncrementPercentage > 0, 'must be greater than zero');

        minBidIncrementPercentage = _minBidIncrementPercentage;

        emit AuctionMinBidIncrementPercentageUpdated(_minBidIncrementPercentage);
    }

Impact

When a value greater than 255 is passed to setMinBidIncrementPercentage, it causes the function to revert. This means that the max minimum percentage difference between the last bid amount and the current bid that can be set is 2.55. So the max value that can be set for the current bid is last bid amount * 2.55. If the owner wants to set a greater amount (for example: current bid = last bid amount * 3.50) this isn't possible because he/she needs to pass 350 in the setMinBidIncrementPercentage. This restricts the owner functionality that for special cases would like to increase this parameter and can't, limiting the protocol flexibility.

Mitigation

Consider using a larger integer type (e.g., uint16) for minBidIncrementPercentage.