TempleGold
TempleDAO
Foundry
25,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

A SpiceAuction with `TGLD` as the `spiceToken` cannot be created

bbash

Summary

A _rescuer or _executor cannot call the createAuction function with TGLD as the spiceToken due to revert.

Vulnerability Details

According to the docs, the following information is given for the contracts/templegold/SpiceAuction.sol:

A special auction configured with a "spice" token and TGLD. For every auction epoch spice token or TGLD can be the auction token or vice versa. Spice auctions are controlled by governance. Configuration for an epoch is set before the epoch auction starts.

So, templeGold or TGLD can be used as the spiceToken also. However, in the SpiceAuctionFactory.sol contract, there is a revert in the createAuction function if the TGLD or templeGold is set as the spiceToken.

https://github.com/Cyfrin/2024-07-templegold/blob/main/protocol/contracts/templegold/SpiceAuctionFactory.sol#L39-L48

function createAuction(address spiceToken, string memory name) external override onlyElevatedAccess returns (address) {
if (spiceToken == address(0)) { revert CommonEventsAndErrors.InvalidAddress(); }
if (spiceToken == templeGold) { revert CommonEventsAndErrors.InvalidParam(); } //@audit
SpiceAuction spiceAuction = new SpiceAuction(templeGold, spiceToken, daoExecutor, name);
bytes32 pairId = _getPairHash(spiceToken);
/// @dev not checking pair address exists to allow overwrite in case of a migration
deployedAuctions[pairId] = address(spiceAuction);
emit AuctionCreated(pairId, address(spiceAuction));
return address(spiceAuction);
}

Impact

A SpiceAuction with TGLD as the spiceToken cannot be created which contradicts the docs.

Tools Used

Manual Review

Recommendations

Allow TGLD as the spiceToken by removing the following check in the createAuction function:

if (spiceToken == templeGold) { revert CommonEventsAndErrors.InvalidParam(); } //@audit
Updates

Lead Judging Commences

inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.