Forbidden withdrawals because of wrong clearingQuote setting

[code423n4]

Lines of code

https://github.com/code-423n4/2022-11-size/blob/706a77e585d0852eae6ba0dca73dc73eb37f8fb6/src/SizeSealed.sol#L217

Vulnerability details

Impact

In finalize function clearingQuote may be set to type(uint256).max
Then checks atState() will fail in refund() and withdraw() functions and it will impossible to return money to bidders

Proof of Concept

1. Seller calls reveal() function for finished auction with no finalizeData
2. Malicious user calls finalize() with ``clearingQuote = type(uint256).max```
3. Then checks atState(idToAuction[auctionId], States.Finalized) in refund() and withdraw() will fail

Tools Used

vs code

Recommended Mitigation Steps

check clearingQuote value

[trust1995]

Low quality, not descriptive enough to be satisfactory.

[c4-judge]

0xean marked the issue as duplicate of #252

[c4-judge]

0xean marked the issue as partial-25