# Seller's ability to decrypt bids before reveal could result in a much higher clearing price than anticpated and make buyers distrust the system

Seller can decrypt all bids before reveal, then bid via an alt address to raise the clearing price or withhold their key to void the auction.

- Payout: Contest reward
- Severity: medium
- Program: SIZE
- Credited: c7e7eff
- Disclosed: 2023-01-09
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-11-size-findings/issues/194
- Library page: https://bugbountylibrary.com/r/c4%3A2022-11-size%3AM-05
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** Sealed-bid auction contract (SizeSealed.sol)
**Root cause:** Bids are encrypted only with the seller's public key, so the seller can decrypt all bids before reveal and finalize; the same-address check in bid() is trivially bypassed with a second address.
**Steps:**
1. Seller creates auction; bidders submit bids encrypted to seller's public key.
2. Seller decrypts bids off-chain to learn the highest bid.
3. Seller submits own bid from an alternate address just above the next-highest bid (`bidder3.bidOnAuctionWithSalt(1 ether, 2e6, "seller")`).
4. Seller calls `finalize(bidIndices, 1 ether, expectedClearingPrice)` including their own bid to set lowestQuote to 2e6 instead of 1e6.
5. Alternatively seller simply never reveals their private key, voiding the auction if bids are unsatisfactory.
**How found:** Code reading of the bid encryption scheme: bids encrypted to seller's public key mean seller has full pre-reveal visibility; noted the same-address check in bid() is bypassable with a second wallet.
**Exploitation:** Seller reads all encrypted bids before reveal, then places a competing bid from a fresh address to push the clearing price up to just under the top bid, or refuses to reveal to cancel the auction entirely.
**Insight:** When a commit-reveal or sealed-bid scheme encrypts only to one party's key, that party is an oracle over all secrets; check whether the trusted decryptor can also participate in the auction via a fresh address, defeating any same-address guard.