Summary

DaiGoldAuction claim will always leave some dust inside the contract

Vulnerability Details

claim calculates how much each user is owned by multiplying bidTokenAmount by totalAuctionTokenAmount and then dividing the result by totalBidTokenAmount, while rounding down.

However unlike SpiceAuction, DaiGoldAuction has no way to retrieve the dust that is left out. This may seems small at first glance, but this rounding will round down on every claim call, on every auction, slowly accumulating over time.

Impact

Small amounts of tokens will end up stuck inside the contract.

Tools Used

Manual review

Recommendations

Create a function to rescue this dust, or use the _claimedAuctionTokens mechanic from SpiceAuction.