Highest bidder can withdraw his collateral due to a missing check in _cancelAllBids
A bidder with the highest bid cannot cancel his bid since this would break the auction. A check to ensure this was implemented in `_cancelBid`.\\nHowever, this check was not implemented in `_cancelAllBids`, allowing the highest bidder to withdraw his collateral and win the auction for free.\\nThe highest bidder should not be able to cancel his bid, since this would break the entire auction mechanism.\\nIn `_cancelBid` we can find a require check that ensures this:\\n```\\n        require(\\n            bidder != l.highestBids[tokenId][round].bidder,\\n            'EnglishPeriodicAuction: Cannot cancel bid if highest bidder'\\n        );\\n```\\n\\nYet in `_cancelAllBids`, this check was not implemented.\\n```\\n     * @notice Cancel bids for all rounds\\n     */\\n    function _cancelAllBids(uint256 tokenId, address bidder) internal {\\n        EnglishPeriodicAuctionStorage.Layout\\n            storage l = EnglishPeriodicAuctionStorage.layout();\\n\\n        uint256 currentAuctionRound = l.currentAuctionRound[tokenId];\\n\\n        for (uint256 i = 0; i <= currentAuctionRound; i++) {\\n            Bid storage bid = l.bids[tokenId][i][bidder];\\n\\n            if (bid.collateralAmount > 0) {\\n                // Make collateral available to withdraw\\n                l.availableCollateral[bidder] += bid.collateralAmount;\\n\\n                // Reset collateral and bid\\n                bid.collateralAmount = 0;\\n                bid.bidAmount = 0;\\n            }\\n        }\\n    }\\n```\\n\\nExample: User Bob bids 10 eth and takes the highest bidder spot. Bob calls `cancelAllBidsAndWithdrawCollateral`.\\nThe `_cancelAllBids` function is called and this makes all the collateral from all his bids from every round available to Bob. This includes the current round `<=` and does not check if Bob is the current highest bidder. Nor is `l.highestBids[tokenId][round].bidder` reset, so the system still has Bob as the highest bidder.\\nThen `_withdrawCollateral` is automatically called and Bob receives his 10 eth back.\\nThe auction ends. If Bob is still the highest bidder, he wins the auction and his bidAmount of 10 eth is added to the availableCollateral of the oldBidder.\\nIf there currently is more than 10 eth in the contract (ongoing auctions, bids that have not withdrawn), then the oldBidder can withdraw 10 eth. But this means that in the future a withdraw will fail due to this missing 10 eth.
Implement the require check from _cancelBid to _cancelAllBids.
A malicious user can win an auction for free.\\nAdditionally, either the oldBidder or some other user in the future will suffer the loss.\\nIf this is repeated multiple times, it will drain the contract balance and all users will lose their locked collateral.
```\\n        require(\\n            bidder != l.highestBids[tokenId][round].bidder,\\n            'EnglishPeriodicAuction: Cannot cancel bid if highest bidder'\\n        );\\n```\\n