Submission Details
Severity:
Flawed auction mechanism
Summary
The auction mechanism is flawed leading to user's making losses or not participating
Vulnerability Detail
The current design of the auction requires bidder's to blindly bid(ie. without knowing how much of the auction token they will get in return). This will cause the bidder's to refrain from participation as they can't estimate their return on the spent amount due to the inclusion of other user's bids
function claim(uint256 epochId) external virtual override {
....
delete depositors[msg.sender][epochId];
// @audit totalBidTokenAmount will only be known at the end of the draw
=> uint256 claimAmount = bidTokenAmount.mulDivRound(info.totalAuctionTokenAmount, info.totalBidTokenAmount, false);
templeGold.safeTransfer(msg.sender, claimAmount);
Impact
Either's users will have to eat losses or user's will refrain from participating in the auctions
Tool used
Manual Review
Recommendation
Use a different mechanism for the auction which allows market participation
Prize pool breakdown
Total prize
25,000 USDC
nSLOC
99825 USDC / LOC
20,000 USDC
2,500 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.