TempleGold
TempleDAO
Foundry
25,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

`DaiGoldAuction.startAuction()` can be DoSed by anyone calling `DaiGoldAuction.distributeGold()` frequently

0xhals

Summary

DaiGoldAuction.startAuction() can be DoSed by anyone calling DaiGoldAuction.distributeGold() before the auction starter calls DaiGoldAuction.startAuction()

Vulnerability Details

When the auction starter calls DaiGoldAuction.startAuction(), the _distributeGold() internal function will call the templeGold.mint() to mint new $TGLD tokes to be distributed, where this function enforces a minimum mint amount to be distributed, otherwise the txn will revert:

function mint() external override onlyArbitrum {
//...
uint256 mintAmount = _getMintAmount(vestingFactorCache);
//...
if (!_canDistribute(mintAmount)) {
return;
}
​
lastMintTimestamp = uint32(block.timestamp);
//...
}

where the minimum mint amount is first calculated based on the time elapsed from the last call to the mint() function:

function _getMintAmount(
VestingFactor memory vestingFactorCache
) private view returns (uint256 mintAmount) {
uint32 _lastMintTimestamp = lastMintTimestamp;
uint256 totalSupplyCache = _totalDistributed;
/// @dev if vesting factor is not set, return 0. `_lastMintTimestamp` is set when vesting factor is set
if (_lastMintTimestamp == 0) {
return 0;
}
​
mintAmount = TempleMath.mulDivRound(
(block.timestamp - _lastMintTimestamp) * (MAX_SUPPLY),
vestingFactorCache.numerator,
vestingFactorCache.denominator,
false
);
​
if (totalSupplyCache + mintAmount > MAX_SUPPLY) {
unchecked {
mintAmount = MAX_SUPPLY - totalSupplyCache;
}
}
}

and:

function _canDistribute(uint256 mintAmount) private view returns (bool) {
return
mintAmount != 0 && _totalDistributed + mintAmount == MAX_SUPPLY
? true
: mintAmount >= MINIMUM_MINT;
}

So if the mint() function is called frequently; the minmtAmount will be less than the the MINIMUM_MINT, and the _canDistribute(mintAmount) will return false resulting in reverting the transaction.

And as can be noticed; DoSing auction starting can be done by anyone as
the DaiGoldAuction contract has an external distributeGold() function that can be invoked by anyone:

function distributeGold() external {
_distributeGold();
}

Also the TempleGold.mint() function can be accessed by anyone, resulting in DoSing DaiGoldAuction.startAuction() function:

function mint() external override onlyArbitrum {
//...
}

  • Same issue is detected in TempleGoldStaking contract, where malicious actor can postpone (DoS) rewards distribution of an epoch by DoSing TempleGoldStaking.distributeRewards() function when calling TempleGoldStaking.distributeGold() frequently.

Impact

DoSing DaiGoldAuction.startAuction() function.

Tools Used

Manual Review.

Recommendations

Update TempleGold.mint() function to be called by the DaiGoldAuction contract(& TempleGoldStaking contract) and privalaged accounts only.

Updates

Lead Judging Commences

inallhonesty Lead Judge
about 1 year ago
inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.