TempleGold
TempleDAO
Foundry
25,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

`DaiGoldAuction` can be stuck for a week

marswhitehacker

Summary

Any user can make DaiGoldAuction to stuck for a week by starting an auction right after the deploy

Vulnerability Details

DaiGoldAuction does not set config in the constructor. After the deployment, anyone can call startAuction. It will create not valid auction without the correct config and the proper amount of tokens to distribute. It will freeze this function at least for a week. If the config is set right after it, it can stuck for a longer period due to this check:

if (_currentEpochId > 0 && (prevAuctionInfo.endTime + config.auctionsTimeDiff > block.timestamp)) {
revert CannotStartAuction();
}

Impact

Can make construct stuck for at least a week

Tools Used

Manual review

Recommendations

Set the initial config in the constructor or restrict anyone from creating first auction

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

`startAuction` the second the DaiGoldAuction is deployed can be used to DOS the contract

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.