TempleGold

TempleDAO
Foundry
25,000 USDC
View results
Submission Details
Severity: low
Invalid

Lows

[L-01] recoverToken leaves an empty epoch

DaiGoldAuction's recoverToken does not perform _currentEpochId = id - 1; like SpiceAuction. If we recover a token, there would be an empty auction epoch.

https://github.com/Cyfrin/2024-07-templegold/blob/main/protocol/contracts/templegold/DaiGoldAuction.sol#L284

//@audit only deletes the epoch
delete epochs[epochId];

[L-02] removeAuctionConfig won't work if startCooldown == 0

SpiceAuction's removeAuctionConfig will not work when startCooldown == 0. We would not be able to removeAuctionConfig even if the auction has not started yet. We can remove it only during the waiting period, making the auctions more difficult to set up and execute.

[L-03] recoverToken inside SpiceAuction can accidentally recover more tokens

Recovering an ERC20 with 2 addresses will brick the auction. It will recover more for the second address because totalAuctionTokenAllocation and _claimedAuctionTokens[token] are both equal to 0 for the other address. Thus, the full balance is available even though totalAuctionTokenAllocation can be more than 0 for the first address.

[QA-01] Rename MINIMUM_AUCTION_PERIOD to MINIMUM_AUCTION_DURATION

MINIMUM_AUCTION_PERIOD can be confused with something similar to MAXIMUM_AUCTION_WAIT_PERIOD as it has PERIOD in its name. However, it functions like a DURATION.
https://github.com/Cyfrin/2024-07-templegold/blob/main/protocol/contracts/templegold/SpiceAuction.sol#L37

uint32 public constant MINIMUM_AUCTION_PERIOD = 1 weeks;

[QA-02] Rename isCurrentEpochEnded to hasCurrentEpochEnded

DaiGoldAuction's isCurrentEpochEnded has incorrect spelling.
https://github.com/Cyfrin/2024-07-templegold/blob/main/protocol/contracts/templegold/DaiGoldAuction.sol#L207

function isCurrentEpochEnded() external view override returns (bool) {
return epochs[_currentEpochId].hasEnded();
}

[QA-03] startAuction doesn't need time check

DaiGoldAuction's startAuction does not need !prevAuctionInfo.hasEnded(), as it already checks for endTime + auctionsTimeDiff > block.timestamp.
https://github.com/Cyfrin/2024-07-templegold/blob/main/protocol/contracts/templegold/DaiGoldAuction.sol#L106

if (!prevAuctionInfo.hasEnded()) {
revert CannotStartAuction();
}
Updates

Lead Judging Commences

inallhonesty Lead Judge
11 months ago
inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.