TempleGold
TempleDAO
Foundry
25,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

No Upper Limit Check for auctionStartCooldown and auctionsTimeDiff in the setAuctionConfig Function of DaiGoldAuction

sohrabhind

Summary

In the DaiGoldAuction contract, if the executor sets a high value for auctionStartCooldown in the setAuctionConfig function and someone starts an auction, it will cause a Denial of Service (DoS) until the auction period passes.

Vulnerability Details

This vulnerability will cause a DoS to multiple functions (setAuctionConfig, setAuctionStarter, setBidToken, startAuction, bid, claim) until the cooldown period has passed or the executor calls the recoverToken function, which deletes the current epoch data.

Proof of concept

​
function test_DoS() public {
_setVestingFactor(templeGold);
vm.startPrank(executor);
IDaiGoldAuction.AuctionConfig memory _config = _getAuctionConfig();
// Will casuse DoS if executor set high auctionStartCooldown and auctionStarter start an auction
_config.auctionStartCooldown = 1000000000;
daiGoldAuction.setAuctionConfig(_config);
// distribute some TGLD
skip(1 days);
templeGold.mint();
daiGoldAuction.startAuction();
​
// Skip time
skip(500 days);
_config.auctionStartCooldown = 60 days;
// Can't set new config
// Due to line 69: if (!epochs[_currentEpochId].hasEnded()) { revert InvalidOperation(); }
vm.expectRevert(abi.encodeWithSelector(IAuctionBase.InvalidOperation.selector));
daiGoldAuction.setAuctionConfig(_config);
​
templeGold.mint();
// Can't start a new auction because the previous auction has not ended
// Due to line 106: if (!prevAuctionInfo.hasEnded()) { revert CannotStartAuction(); }
vm.expectRevert(abi.encodeWithSelector(IAuctionBase.CannotStartAuction.selector));
daiGoldAuction.startAuction();
}

Impact

While this issue will not cause any financial loss, it can still disrupt the normal operation of the contract. Therefore, the impact will be low.

Tools Used

Manual Review, Foundry

Recommendations

Implement input validation for auction configuration parameters. Ensure that auctionStartCooldown and auctionsTimeDiff are within reasonable limits to prevent excessively high values.

Updates

Lead Judging Commences

inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.