TempleGold
TempleDAO
Foundry
25,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

`DaiGoldAuction::recoverToken` does not decrease epochId

marswhitehacker

Summary

DaiGoldAuction::recoverToken does not decrease epochId which leads to wrong period difference between just deleted and next auctions

Vulnerability Details

Imagine we started an auction and increased epochId to let's say 10. Than we called recoverToken, it removed this epoch, which means all its struct variables are set to default values, as well as endTime to zero. So when starting next auction, this will pass even if wait period has not ended:

if (_currentEpochId > 0 && (prevAuctionInfo.endTime + config.auctionsTimeDiff > block.timestamp)) {
revert CannotStartAuction();
}

Because prevAuctionInfo.endTime would be zero, as it is counted for a removed epoch

Impact

Can skip wait period

Tools Used

Manual review

Recommendations

Decrease epochId when removing the epoch

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

two auctions can be started with less than auctionsTimeDiff time difference due to recoverToken deleting the epochs[epochId]

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.