Double-counted auctioneer
The registerAuctioneer function allows to register a previously registered auctioneer. We recommend adding a check as shown below:
function registerAuctioneer(IBondAuctioneer auctioneer_) external requiresAuth {
require(_whitelist[address(auctioneer_)] == false, "already registered");
auctioneers.push(auctioneer_);
_whitelist[address(auctioneer_)] = true;
}Remediation
Bond Labs acknowledged this finding and implemented a fix in commit 35687b13↗.