Race condition in auction contract

[joe-p]

Overview

In the current contract, there is a race condition when placing a bid. The contract will attempt to repay the previous bidder, but the previous bidder can change within a block. The current design will only allow one bid per block.

Solution

Rather than immediately repaying the previous bidder, this functionality should be implemented as a separate method. Below is an example implementation of this.

https://github.com/algorand-devrel/beaker-auction/blob/master/backend/smart_contracts/auction/contract.py