TempleGold

Summary

The recoverToken function in the DaiGoldAuction.sol contract allows the admin to recover templeGold tokens from the contract. However, when recovering templeGold tokens, the function deletes the current auction epoch’s data, which can lead to potential issues if the startAuction function is called afterward. Specifically, the current epoch is removed, but the currentEpoch variable is not decremented, which can cause inconsistencies and potentially allow the start of a new auction with an empty or invalid epoch.

Vulnerability Details

The recoverToken function in DaiGoldAuction.sol is defined as follows:

When templeGold tokens are recovered, the function deletes the current epoch’s data, which can result in:

1. Invalid Epoch State: Deleting the current epoch data without updating the currentEpoch variable may lead to inconsistencies. The currentEpoch variable still points to a non-existent epoch, which could cause logical errors in functions that depend on this variable.

2. Unintended Auction Start: If the startAuction function is called after recovering the tokens, it might allow users to start a new auction with an empty epoch, thus breaking the auction logic and potentially allowing an auction with no valid epoch data.

Here’s an example scenario:

1. Admin recovers templeGold tokens while the current auction epoch has not ended.

2. The currentEpoch variable still points to the deleted epoch, which is now empty.

3. A user can call the startAuction function, which may not check for the validity of currentEpoch, allowing an auction to start with invalid data.

Impact

The impact of this vulnerability includes:

1. Logical Errors in Auction Management: By deleting the current epoch data without updating currentEpoch, the contract may enter an inconsistent state where the currentEpoch variable points to a non-existent or invalid epoch.

2. Potential for Invalid Auctions: An attacker or unintended user might exploit this state to start a new auction when no valid auction epoch exists, potentially disrupting the auction process and causing confusion.

Recommendations

1. Update Epoch Management: When recovering templeGold tokens, ensure that the currentEpoch variable is decremented to point to the previous valid epoch, if applicable. This can be done by adding a step to adjust currentEpoch after deleting the epoch data.

   Example fix:

   delete epochs[epochId];

   if (_currentEpochId > 0) {

   _currentEpochId--;

   }

   nextAuctionGoldAmount += _totalAuctionTokenAmount - amount;

2. Add Epoch Validity Checks: Ensure that the startAuction function checks the validity of currentEpoch and prevents the creation of a new auction if currentEpoch points to a non-existent or invalid epoch.