Auction.sol#settleAuction() addBounty with a fake token could potentially disrupt settleAuction()

[code423n4]

Handle

WatchPug

Vulnerability details

https://github.com/code-423n4/2021-09-defiProtocol/blob/main/contracts/contracts/Auction.sol#L102

Anyone can call addBounty() to add a bounty with any token. If we assume that the frontend will always pass all the bountyIDs of active bounties to settleAuction(), then a malicious user can disrupt settleAuction() by addBounty with a fake token that always reverts when calling transfer().

Impact

Auction bonder wont be able to settleAuction(). The malicious user and all other holders of the basket token can belifits from the burn of the auction bond.

Proof of Concept

1. Create a fake token that allways reverts at transfer();
2. addBounty with the fake token and any amount;
3. Calling settleAuction with bountyIDs including the fake token bounty will always fail.

Recommended Mitigation Steps

Whitelist bounty tokens in smart contract or frontend.

[GalloDaSballo]

By adding a malicious token as bounty, we can make the settleAuction transaction revert.
Simple mitigation is to not claim that bounty.

Generally speaking this can be viewed as medium severity because it's dependent on an external condition.
But personally I think mitigation and likelihood are so low that I'll downgrade to low.

Will mark as low, because all it takes to avoid this type of griefing is to remove the bounty from the list, the fact that the frontend may not has no relevance for this contest