[Bug]: Highest Bidder is allowed to withdraw from escrow_payment_account with Auctioneer

[akkoucai]

Which package is this bug report for?

auction-house

Which Type of Package is this bug report for?

Rust Contract

Issue description

1. A seller starts an auction with Auctioneer and set up the listing config to not allow highest bidder to cancel its bid,
2. Someone bids for this auction and become the highest bidder.
3. The highest bidder withdraw its fund from escrow_payment_account after the auction ends (or before because it doesn't matter here because listing config doesn't update the highest bidder),
4. The Auction has ended but when the highest bidder tries to execute_sale, it throws an error because the escrow account has insufficient funds.
5. This may seem logical given the architecture of the program but it would mean that a malicious person could outbid every time as long as they have the funds but they won't suffer any consequences (apart from the transaction fees) from that because they can withdraw their funds as they wish at the end and the seller could end up never being able to auction off their token.

Relevant log output

"Program log: Instruction: AuctioneerExecuteSale"
"Program log: AnchorError occurred. Error Code: InsufficientFunds. Error Number: 6043. Error Message: Insufficient funds in escrow account to purchase.."

Priority this issue should have

High (immediate attention needed)