TempleGold
TempleDAO
Foundry
25,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Event emission with wrong parameters in `SpiceAuction::removeAuctionConfig()`

Trident Audits

Summary

The SpiceAuction::removeAuctionConfig() emits the AuctionConfigRemoved event with wrong parameters at L#131. The epochId must always be 1 less than the configId (the else block deals with the case where auction config is set but the auction hasn't started yet), however, it is hard-coded to 0.

Vulnerability Details

Consider the following code segment from SpiceAuction::removeAuctionConfig() function,

function removeAuctionConfig() external override onlyDAOExecutor {
// ...
​
} else {
// `auctionStart` is not triggered but `auctionConfig` is set
id += 1;
delete auctionConfigs[id];
@> emit AuctionConfigRemoved(id, 0);
}
}

Suppose the config for the 3rd spice auction is set with id 3. Since the auction hasn't started yet, epoch id is not in sync with the auction id (epoch id is still at 2). This scenario can be generalized to say that for the nth auction id which hasn't started yet, the epoch id is still at (n-1). When the config for auction id 3 is removed, config id should be 3 and epoch id should be 2. The event parameters are defined in ISpiceAuction interface as follows,

event AuctionConfigRemoved(uint256 configId, uint256 epochId);

Thus, in this case, the epoch id must be one less than the config id.

Impact

Events are used by off-chain services to track contract activities. Incorrect event emission may cause unforseen discrepancies.

Tools Used

Manual review. Foundry.

Recommended Mitigation

Make the following changes in SpiceAuction::removeAuctionConfig(),

function removeAuctionConfig() external override onlyDAOExecutor {
// ...
​
} else {
// `auctionStart` is not triggered but `auctionConfig` is set
id += 1;
delete auctionConfigs[id];
- emit AuctionConfigRemoved(id, 0);
+ emit AuctionConfigRemoved(id, id - 1);
}
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.