TempleGold
TempleDAO
Foundry
25,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

`AuctionConfigSet` event in `DaiGoldAuction::setAuctionConfig()` function emits `_currentEpochId` which is still set at the last epochId

Trident Audits

Summary

setAuctionConfig is used to set the configuration for an auction before it starts. The AuctionConfigSet event is supposed to emit the ID of the auction for which the config has been set along with the config itself, but in the current implementation the ID will always point to the previous auction epoch.

Vulnerability Details

NOTE
Auction ID is used to better represent the latest auction number, it is not an actual state variable.

_currentEpochId points to the previous auction ID and is incremented after a successful call to DaiGoldAuction::startAuction(). Due to this fact, the epochID emitted in AuctionConfigSetevent after setting auctionConfig is always set at n-1, where n is the current auction ID. Current implementation can be seen below:

function setAuctionConfig(AuctionConfig calldata _config) external override onlyElevatedAccess {
//code
​
auctionConfig = _config;
​
@> emit AuctionConfigSet(_currentEpochId, _config);
}

Impact

As events are used by off-chain services to track contract activities, incorrect event emission may cause unforseen discrepancies.
This can lead subgraphs and users to believe that the configuration has been set for an auction ID, say n, but in reality the current auction ID would be n + 1.

Recommendations

Update DaiGoldAuction::setAuctionConfig() at L#72 to emit the current auction ID and not the previous one.

function setAuctionConfig(AuctionConfig calldata _config) external override onlyElevatedAccess {
//code
​
auctionConfig = _config;
​
- emit AuctionConfigSet(_currentEpochId, _config);
+ emit AuctionConfigSet(_currentEpochId + 1, _config);
}

Tools Used

Manual Review.

Updates

Lead Judging Commences

inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

`AuctionConfigSet` event in `DaiGoldAuction::setAuctionConfig()` function emits `_currentEpochId` which is still set at the last epochId

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.