[Critical] AllPayAuction allows withdrawal before auction deadline

[dhruvi-16-me]

Summary

AllPayAuction.withdraw(uint256 auctionId) can be called before the auction deadline, allowing funds to be withdrawn while bidding is still active. This breaks the intended auction lifecycle and settlement guarantees.

Affected Component

• Contract: AllPayAuction.sol
• Function: withdraw(uint256 auctionId)
• Base lifecycle modifiers defined in: Auction.sol

Problem Description

The protocol explicitly defines auction phases using time-based modifiers:

• beforeDeadline → used for bidding
• onlyAfterDeadline → used for claiming assets

However, withdraw in AllPayAuction does not enforce any deadline check.

As a result, withdraw(auctionId) can be called when:

• block.timestamp < auction.deadline
• bidding is still open
• the deadline may still be extended by new bids

This allows auction funds to be settled prematurely.

Expected Behavior

Withdrawal of accumulated bid funds should only be possible after the auction has ended.

[kaneki003]

@dhruvi-16-me there is no problem in the logic.
The main idea of this protocol is once a bid made it won't be refunded disregard of the outcome of auction.
So if the auctioneer is withdrawing before auction is actually finished ,the mechanics of ongoing auction won't be disrupted.

[dhruvi-16-me]

@kaneki003 Okay thanks for clarifying this thing 👍.