TempleGold
TempleDAO
Foundry
25,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

recoverToken will not allow users to withdraw tokens if auction is in cool down period

0xaman

Summary

The protocol allows the DAOExecutor to withdraw tokens from an auction if the auction has not started yet or has ended and there is no configuration set for the next epoch. However, it does not allow the DAOExecutor to withdraw tokens if the auction is still in the cooldown period.

Vulnerability Details

The auction can be in one of the following states:

  1. The auction has not started.

  2. The auction has started but is in the cooldown period, meaning it is not active yet.

  3. The auction is active, allowing anyone to bid.

  4. The auction has ended, and no one can bid.

When the tokens can be recovered from auction if :

  1. The auction is in cool down Period.

  2. The auction has ended and next auctionConfigs has not set.

The issue arises when the auction has started but is in the cooldown period. Since uint128 startTime = info.startTime = uint128(block.timestamp) + config.startCooldown;, the tokens cannot be recovered, even though logically they could be, as done in the DaiGoldAuction contract.

POC"

​
function test_cannot_recoverToken_spice() public {
vm.startPrank(daoExecutor);
address _spiceToken = spice.spiceToken();
dealAdditional(IERC20(_spiceToken), address(spice), 50 ether);
​
address _templeGold = address(templeGold);
uint256 recoverAmount = 50 ether;
ISpiceAuction.SpiceAuctionConfig memory _config = _getAuctionConfig();
_startAuction(true, true);
IAuctionBase.EpochInfo memory info = spice.getEpochInfo(1);
vm.warp(info.startTime - 1 minutes); // in cooldown peroid
vm.startPrank(daoExecutor);
// first try to recoever token direct : it will revert RemoveAuctionConfig
vm.expectRevert(abi.encodeWithSelector(ISpiceAuction.RemoveAuctionConfig.selector));
spice.recoverToken(address(templeGold), alice, recoverAmount);
// now I will remove the auction config and tries recover tokens for this auction
spice.removeAuctionConfig();
// here it will revert with InvalidConfigOperation
vm.expectRevert(abi.encodeWithSelector(ISpiceAuction.InvalidConfigOperation.selector));
spice.recoverToken(address(templeGold), alice, recoverAmount);
​
}

run with the command : forge test --mt test_cannot_recoverToken_spice.

Impact

Tokens cannot be recovered while the auction is in the cooldown period. However, if auctionStart is called, as demonstrated in my proof of concept (POC), the tokens still cannot be recovered.

Tools Used

Manual Review

Recommendations

Allow DAOExecutor to recover token in case of auction is in coll down period as done in DaiGoldAuction

Updates

Lead Judging Commences

inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Appeal created

0xaman Submitter
11 months ago
inallhonesty Lead Judge
11 months ago
inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.