agentsclimarketplace
Sign in

Audit auction

Skill auditmos/skills/skills/audit-auction

Audits Solidity auction mechanisms for manipulation vulnerabilities including self-bidding to reset auction timer, auction start during L2 sequencer downtime affecting timing fairness, insufficient auction length validation allowing very short auctions for immediate seizure, and off-by-one errors allowing seizure during active auction period (project)From its SKILL.md

Install
npx -y skills add auditmos/skills --skill audit-auction

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 14 stars14 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

5.2 KB, as published. Nobody here has run it

Auction Manipulation Auditor

When to Use

  • Auditing auction mechanisms, Dutch auctions, liquidation auctions
  • User mentions: auction, bid, Dutch auction, auction timer, auction length, sequencer downtime, seizure
  • Analyzing auction timing, bid validation, auction parameters
  • Reviewing liquidation auctions, loan auctions, NFT auctions

Audit Workflow

IMPORTANT: Announce skill usage at the start of analysis

Begin with: "I'm using the audit-auction skill to analyze this contract for auction manipulation vulnerabilities..."

  1. Scan for auction operations

    • Search: auction, bid, startAuction, endAuction, auctionEnd, auctionLength, buyLoan, seize, settle
    • Focus: timer resets, length validation, timestamp checks, sequencer integration

  2. Check against vulnerability patterns

    • Reference reference.md for complete checklist
    • Compare code against example.md

  3. Validate exploitability

    • Check access control first - grep for onlyOwner|onlyAdmin|onlyGovernance modifiers
    • Can non-privileged actors exploit auction manipulation?
    • Can borrower reset auction by self-bidding?
    • Can auctions start during sequencer downtime?
    • Are auction lengths validated (minimum duration)?
    • Are timestamp comparisons correct (no off-by-one)?
    • Verify no compensating protections exist
    • Downgrade severity if admin-only unless enables borrower manipulation

  4. Generate report

    • Use deliverable template below
    • Include manipulation scenarios and PoC
    • Rank by severity

Core Vulnerability Patterns

See reference.md for full checklist. Key patterns:

  1. Self-bidding to reset auction → borrower buys own loan to restart timer indefinitely
  2. Auction start during sequencer downtime → L2 sequencer issues affect fairness
  3. Insufficient auction length validation → 1-second auctions allow immediate seizure
  4. Auction seizure during active period → off-by-one allows premature seizure

Code examples: See example.md

Severity Criteria

Critical: Self-bidding allowing infinite auction extensions, off-by-one enabling immediate seizure bypassing auction period, MUST be exploitable by non-privileged actors High: Insufficient length validation allowing very short auctions, sequencer downtime affecting auction fairness on L2, MUST be exploitable by non-privileged actors Medium: Suboptimal auction parameters, missing events for auction state changes, admin-only auction configuration issues with cascading borrower impact Low: Gas inefficiencies in auction logic, missing view functions, admin-only parameter issues without immediate borrower impact

IMPORTANT: Admin-only auction functions (onlyOwner, onlyAdmin, onlyGovernance) are MEDIUM or LOW severity unless:

  • Admin can start auctions during sequencer downtime without checks
  • Missing validation in auction length setters allows admin to set 1-second auctions
  • Admin auction timing configuration enables unfair seizure of borrower collateral

False Positives - Do NOT Flag

  • Protocols with explicit self-bidding allowed (documented)
  • L1-only deployments (no sequencer concerns)
  • Admin-only auction start (trusted operation)
  • Intentional short auctions with documented rationale
  • Test/mock auction contracts
  • Admin-only auction start functions (onlyOwner, onlyAdmin) with sequencer uptime checks on L2
  • Governance-controlled auction length parameters with minimum bounds validation (e.g., >= 1 hour)
  • Admin functions for emergency auction settlement with documented safeguards

Deliverable Format

MANDATORY: Before deliverable, verify each checklist.md item against codebase. Flag violations as findings.

Use template: templates/report-template.md

Each finding includes: severity, pattern #, file/lines, description, vulnerable code, manipulation scenario, PoC, remediation.

Key Principles

  • No self-bidding - prevent borrower from bidding on own auction
  • Sequencer awareness - check sequencer uptime before auction start on L2
  • Minimum duration - enforce reasonable minimum (e.g., 1 hour)
  • Correct comparisons - use >= not >, avoid off-by-one
  • Timer integrity - prevent auction timer resets

Output Guidelines

DO:

  • Reference specific lines and functions
  • Provide manipulation scenarios with timing
  • Show PoCs demonstrating auction abuse
  • Calculate impact of timing exploits
  • Map all auction state transitions

DON'T:

  • Report intentional design choices (short auctions with rationale)
  • Flag missing features with alternative mechanisms
  • Ignore timestamp precision (critical for fairness)
  • Miss edge cases (exact timestamp boundaries)

Keep looking

Skills are one crate of 627,801. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.