The last bidder can't get fund back when quote token has transfer fee

[code423n4]

Lines of code

https://github.com/code-423n4/2022-11-size/blob/main/src/SizeSealed.sol#L164

Vulnerability details

Impact

In 'bid()' function, there is no security check if the actual received token is equal to 'quoteAmount' . When the quote token has transfer fee, the last bidder won't be able to get refund.

function bid(
    // ...
) external atState(idToAuction[auctionId], States.AcceptingBids) returns (uint256) {
    // ...

    EncryptedBid memory ebid;
    ebid.quoteAmount = quoteAmount;
    // ...
    a.bids.push(ebid);

    SafeTransferLib.safeTransferFrom(ERC20(a.params.quoteToken), msg.sender, address(this), quoteAmount); 
    // ...
}

Proof of Concept

Given

quoteToken = $TKN
fee = 5%
initBalanceOfContract = 0 $TKN

Bidder A bids with 100 $TKN, then

ebidA.quoteAmount = 100 $TKN
balanceOfContract = 100 $TKN * 95% = 95 $TKN

Bidder B bids with 100 $TKN, then

ebidB.quoteAmount = 100 $TKN
balanceOfContract = 95 $TKN + 100 $TKN * 95% = 190 $TKN

Bidder A cancels bid

ebidA.quoteAmount = 100 $TKN - 100 $TKN = 0 $TKN
balanceOfContract = 190 $TKN - 100 $TKN = 90 $TKN

Bidder B cancels bid

ebidB.quoteAmount = 100 $TKN - 100 $TKN = 0 $TKN
balanceOfContract = 90 $TKN - 100 $TKN = ??? // Failed

Tools Used

VS Code

Recommended Mitigation Steps

Revert if the actual received token is not equal to 'quoteAmount'.

[c4-judge]

0xean marked the issue as duplicate

[c4-judge]

0xean marked the issue as satisfactory

[c4-judge]

0xean changed the severity to 2 (Med Risk)