TempleGold
TempleDAO
Foundry
25,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

First Auction Config in `SpiceAuction.sol` can not be removed

Triad of Trust

Summary

https://github.com/Cyfrin/2024-07-templegold/blob/57a3e597e9199f9e9e0c26aab2123332eb19cc28/protocol/contracts/templegold/SpiceAuction.sol#L107-L133

The first ever created Auction Config in SpiceAuction.sol will revert if you try and remove it via SpiceAuction::removeAuctionConfig.

Vulnerability Details

Inside SpiceAuction::removeAuctionConfig there is a check that if info.startTime == 0 on that epoch it will revert. We grab the current epoch from the state variable AuctionBase::_currentEpochId, which is the last epoch as natspec says -
/// @notice Remove auction config set for last epoch. But on the first ever created auction config, there is no prior epochs making the daoExecutor unable to remove the first auction config ever created since EpochInfo.startTime is only ever updated inside SpiceAuction::startAuction.

Add this PoC in SpiceAuction.t.sol-

function test_firstConfigReverts() public {
// set config
vm.startPrank(daoExecutor);
ISpiceAuction.SpiceAuctionConfig memory _config = _getAuctionConfig();
spice.setAuctionConfig(_config);
​
// reverts when removing first auction config
vm.expectRevert();
spice.removeAuctionConfig();
​
vm.startPrank(alice);
vm.warp(block.timestamp + _config.waitPeriod);
IERC20 auctionToken = IERC20(_getAuctionToken(_config.isTempleGoldAuctionToken, daiToken));
dealAdditional(auctionToken, address(spice), 100 ether);
uint256 epoch = spice.currentEpoch();
IAuctionBase.EpochInfo memory epochInfo = spice.getEpochInfo(epoch);
spice.startAuction();
epochInfo = spice.getEpochInfo(epoch+1);
vm.warp(epochInfo.endTime);
_config = _getAuctionConfig();
_config.starter = address(0);
_config.startCooldown = 0;
vm.startPrank(daoExecutor);
spice.setAuctionConfig(_config);
​
// can remove latest auction config now
spice.removeAuctionConfig();
}

Impact

If the daoExecutor messes up the first auction config, it hinders the contract useless since he can not remove it and create a new one to fix any mistakes without redeploying.

Tools Used

Foundry

Recommendations

Add a condition inside SpiceAuction::removeAuctionConfig that if it's the first Auction Config ever, you can still remove the config, even if EpochInfo.startTime is 0.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

`removeAuctionConfig` can't remove the first added `SpiceAuctionConfig` which in the end leads to inability to recover the funds associated to that auction

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.