medium10 pts · first answer countssmart-contract-securitysolidity

Refunding outbid bidders

In an auction, the contract sends ETH back to the previous highest bidder inside bid(). An attacker bids from a contract whose receive() always reverts. What happens, and what is the fix?

A.Nothing bad happens, because failed refunds are ignored by the EVMB.The attacker loses their bid; no fix is neededC.The attacker can drain the auction; the fix is a higher gas limitD.No one can outbid the attacker because every new bid reverts; the fix is to record refunds and let users withdraw them (pull payments)

← Predicting a CREATE2 address Safer ownership transfer →