TempleGold

Summary

As per the Docs,
TGLD Auctions take place on a bi-weekly cadence
and each auction lasts for 1 week.

If an auction epoch ends without receiving a bid,
the TGLD could be locked in the auction contract as there is no mehanism to recover.

Vulnerability Details

Likelihood : Low
Impact : Medium

The vulnerability stems from the lack of a recovery mechanism in the DaiGoldAuction contract,
to handle an edge case of an auction epoch ending without a single bid.

The current recoverToken function reverts if the auction has ended,
meaning the TGLD tokens cannot be moved over to the subsequent epoch auction.

https://github.com/TempleDAO/temple/blob/templegold/protocol/contracts/templegold/DaiGoldAuction.sol#L277-L290

If more epochs end up in the same scenario,
the accumulation of irrecoverable tokens will be a considerable issue.

Impact

If an auction epoch ends without a bid,
TempleGold (TGLD) will be locked in the contract
as there is no mechanism to recover them.

Tools Used

Foundry, Manual Review

Recommendations

The goal is to allow the recovery of TGOLD tokens
if no bids were placed in the epoch,
even if the auction has ended.

Modiy the checks to allow recovery even after the end of auction,

if info.totalBidTokenAmount is zero,