TempleGold
TempleDAO
Foundry
25,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Lack of Recovery Mechanism for Auctions With No Bids in DaiGoldAuction Contract

0xCiphky

Vulnerability Details:

The DaiGoldAuction contract allows bidders to bid DAI in exchange for TGLD when an auction is active. These Temple Gold tokens available for each auction are sent to the DaiGoldAuction contract prior to the auction starting. Once the startAuction function is called, the totalAuctionTokenAmount for the current auction is saved in the auction’s EpochInfo and nextAuctionGoldAmount is reset to zero.

function startAuction() external override {
if (auctionStarter != address(0) && msg.sender != auctionStarter) { revert CommonEventsAndErrors.InvalidAccess(); }
EpochInfo storage prevAuctionInfo = epochs[_currentEpochId];
if (!prevAuctionInfo.hasEnded()) { revert CannotStartAuction(); }
AuctionConfig storage config = auctionConfig;
/// @notice last auction end time plus wait period
if (_currentEpochId > 0 && (prevAuctionInfo.endTime + config.auctionsTimeDiff > block.timestamp)) {
revert CannotStartAuction();
}
_distributeGold();
uint256 totalGoldAmount = nextAuctionGoldAmount;
nextAuctionGoldAmount = 0;
uint256 epochId = _currentEpochId = _currentEpochId + 1;
if (totalGoldAmount < config.auctionMinimumDistributedGold) { revert LowGoldDistributed(totalGoldAmount); }
​
EpochInfo storage info = epochs[epochId];
info.totalAuctionTokenAmount = totalGoldAmount;
uint128 startTime = info.startTime = uint128(block.timestamp) + config.auctionStartCooldown;
uint128 endTime = info.endTime = startTime + AUCTION_DURATION;
​
emit AuctionStarted(epochId, msg.sender, startTime, endTime, totalGoldAmount);
}

The problem is if an auction goes with no bids, there is currently no way to recover the auction amount, and it will be locked up in the contract. The recoverToken function only handles cases where an auction is started but cooldown is pending, so it can’t be used here.

This scenario is correctly handled in the SpiceAuction contract, which includes the recoverAuctionTokenForZeroBidAuction function; however, this function is not present in the DaiGoldAuction contract.

Impact:

If an auction receives no bids, the Temple Gold tokens allocated for that auction will be locked in the contract.

Tools Used:

  • Manual analysis

Recommendation:

Implement a function similar to recoverAuctionTokenForZeroBidAuction from the SpiceAuction contract in the DaiGoldAuction contract. This function should allow recovery of the auctioned tokens if an auction ends with no bids.

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Auctioned tokens cannot be recovered for epochs with empty bids in DaiGoldAuction

Appeal created

0xCiphky Submitter
over 1 year ago
inallhonesty Lead Judge
over 1 year ago
inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Auctioned tokens cannot be recovered for epochs with empty bids in DaiGoldAuction

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.