Auction fails if the 'Honorarium Rate' is 0%
The Honorarium Rate is the required percentage of a winning Auction Pitch bid that the Steward makes to the Creator Circle at the beginning of each Stewardship Cycle.\\n`$$ Winning Bid * Honorarium Rate = Periodic Honorarium $$`\\nTo mimic the dynamics of private ownership, the Creator Circle may choose a 0% Honorarium Rate. However, doing so breaks the functionality of the protocol.\\nTo place a bid, a user must call the `placeBid` function in `EnglishPeriodicAuctionFacet.sol` and deposit collateral(collateralAmount) equal to `bidAmount + feeAmount`. The `feeAmount` here represents the Honorarium Rate mentioned above. The `placeBid` function calls the `_placeBid` internal function in `EnglishPeriodicAuctionInternal.sol` which calculates the `totalCollateralAmount` as follows :\\n```\\nuint256 totalCollateralAmount = bid.collateralAmount + collateralAmount;\\n```\\n\\nHere, `bid.collateralAmount` is the cumulative collateral deposited by the bidder in previous bids during the current auction round(i.e, zero if no bids were placed), and `collateralAmount` is the collateral to be deposited to place the bid. However the `_placeBid` function requires that `totalCollateralAmount` is strictly greater than `bidAmount` if the bidder is not the current owner of the Stewardship License. This check fails when the `feeAmount` is zero and this causes a Denial of Service to users trying to place a bid. Even if the users try to bypass this by depositing a value slightly larger than `bidAmount`, the `_checkBidAmount` function would still revert with `'Incorrect bid amount'`\\nPOC\\nThe following test demonstrates the above-mentioned scenario :\\n```\\n describe('exploit', function () {\\n    it('POC', async function () {\\n      // Auction start: Now + 100\\n      // Auction end: Now + 400\\n      const instance = await getInstance({\\n        auctionLengthSeconds: 300,\\n        initialPeriodStartTime: (await time.latest()) + 100,\\n        licensePeriod: 1000,\\n      });\\n      const licenseMock = await ethers.getContractAt(\\n        'NativeStewardLicenseMock',\\n        instance.address,\\n      );\\n\\n      // Mint token manually\\n      const steward = bidder2.address;\\n      await licenseMock.mintToken(steward, 0);\\n\\n      // Start auction\\n      await time.increase(300);\\n        \\n      const bidAmount = ethers.utils.parseEther('1.0');\\n      const feeAmount = await instance.calculateFeeFromBid(bidAmount);\\n      const collateralAmount = feeAmount.add(bidAmount);\\n\\n      // Reverts when a user tries to place a bid\\n      await expect( instance\\n        .connect(bidder1)\\n        .placeBid(0, bidAmount, { value: collateralAmount })).to.be.revertedWith('EnglishPeriodicAuction: Collateral must be greater than current bid');\\n\\n      \\n    \\n      const extraAmt = ethers.utils.parseEther('0.1');\\n      const collateralAmount1 = feeAmount.add(bidAmount).add(extraAmt);\\n      \\n      // Also reverts when the user tries to deposit collateral slighty greater than bid amount\\n      await expect( instance\\n        .connect(bidder1)\\n        .placeBid(0, bidAmount, { value: collateralAmount1 })).to.be.revertedWith('EnglishPeriodicAuction: Incorrect bid amount');  \\n      \\n      // Only accepts a bid from the current steward\\n      \\n      await expect( instance\\n        .connect(bidder2)\\n        .placeBid(0, bidAmount, { value: 0 })).to.not.be.reverted;\\n\\n    });\\n  });\\n```\\n\\nTo run the test, copy the code above to `EnglishPeriodicAuction.ts` and alter L#68 as follows :\\n```\\n// Remove the line below\\n          [await owner.getAddress(), licensePeriod, 1, 10],\\n// Add the line below\\n          [await owner.getAddress(), licensePeriod, 0, 10],\\n```\\n\\nRun `yarn run hardhat test --grep 'POC'`
Alter EnglishPeriodicAuctionInternal.sol::L#330 as follows :\\n```\\n// Remove the line below\\n totalCollateralAmount > bidAmount,\\n// Add the line below\\n totalCollateralAmount >= bidAmount, \\n```\\n
The protocol becomes dysfunctional in such a scenario as users as DOS'd from placing a bid.
```\\nuint256 totalCollateralAmount = bid.collateralAmount + collateralAmount;\\n```\\n