TempleGold

TempleDAO
Foundry
25,000 USDC
View results
Submission Details
Severity: medium
Invalid

Some auction bidders could get no rewards and losing their deposits

## Summary
Some Auction bidders could get no rewards and losing their deposits if the collected auction tokens is way greater than the amount of auction tokens allocated for distribution.
## Vulnerability Details
When an auction ends, depositors can claim their rewards (auction token) as a ratio from their deposited amount to the total auction deposits:
```javascript
//@note : `SpiceAuction.claim()` function
function claim(uint256 epochId) external virtual override {
EpochInfo storage info = epochs[epochId];
//...
uint256 claimAmount = bidTokenAmount.mulDivRound(
info.totalAuctionTokenAmount,
info.totalBidTokenAmount,
false
);
/// checkpoint claim for auction token
_claimedAuctionTokens[auctionToken] += claimAmount;
IERC20(auctionToken).safeTransfer(msg.sender, claimAmount);
//...
}
```
where `info.totalAuctionTokenAmount` is preset when the auction started and can't be changed afterwards, while the `info.totalBidTokenAmount` is the total amount of bid tokens collected from users when the call `bid()`.
So if there's a large amount of collected bidding tokens while the allocated auction tokens to be distributed is way smaller than the collected bid tokens; this would result in some bidders getting **zero** auction tokens due to rounding down, and by knowing that there's no refund mechanism to claim bid tokens after being deposited, this would cost these bidders to lose their bid tokens without getting any rewards in return.
Same issue in the `DiaGoldAuction.claim()`.
## Impact
Bidders lose their bid tokens without getting any rewards.
## Tools Used
Manual Review.
## Recommendations
Add a mechanism to close bidding if the `epochs[epochId].totalBidTokenAmount` exceeds a predetrmined value, and add a minimum amount check on the bid tokens as a percentage from the allocated auction tokens so that users can't deposit less than this value to ensure getting part of the allocated auction tokens.
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.