Attack the Auction
Welcome to lab03. In this assignment you'll be getting acclimated with external calls, inheritance, and smart contract security.
Your task is to complete both
GoodAuction.sol such that they are each, respectively, vulnerable and protected from three specific security vulnerabilities. Notice that both contracts inherit from
NotPoisoned.sol are players in an adversarial system. Both can conduct external calls to the auctions in order to place bids and lower their bid if they are the current highest bidder. While
NotPoisoned.sol will act as expected,
Poisoned.sol will attempt to take advantage of one of
BadAuction.sol's security vulnerabilities. You Should NOT Change These Contracts
Implement both auctions in order to demonstrate your understanding of what makes smart contracts vulnerable and how to secure them.
All work should be done in contracts/BadAuction.sol and contracts/GoodAuction.sol
- In any situation, a bidder with a lower or the same bid than the current highest bidder should have no effect on the contract
- A bidder with a higher bid should:
- Be able to displace the previous highest bidder if the previous highest bidder were not poisoned
- Be able to displace the previous highest bidder if bidding at a good auction
- Not be able to displace the previous highest bidder if bidding on a bad auction and the previous highest bidder was poisoned
- A previous highest bidder should only get back an amount equivalent to what their bet (the previous highest bet) was; no more, no less
- In GoodAuction the current highest bidder should be able reduce their current bid by 1 using the reduceBid function. In BadAuction, anybody should be able to reduce the highest bidder's current bid.
- In GoodAuction the process of reducing a bid should be protected against underflow.
- All tests should pass
- Each auction file should follow the requirements set by the skeleton code (as well as the
- Do not change any files except for
To test your contracts open a second terminal window and type
ganache-cli to start a local test server. In the other window cd into the assignment root directory and run
If you're having trouble passing the tests and would like to play around with the contracts manually:
PLEASE FORK THIS REPO and push your code up to your fork.
Don't hesitate to reach out to the staff via Piazza should you run into any trouble.