TempleGold
TempleDAO
Foundry
25,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Lack of migration mechanism in `SpiceAuction` contract

merlinboii

Summary

The SpiceAuction contract lacks a migration mechanism, which prevents migration when the SpiceAuction contract for existing token pairs is updated.

Vulnerability Details

When SpiceAuctionFactory.createAuction() attempts to override an existing SpiceAuction contract for migration, the SpiceAuction contract does not support this mechanism.

This could lead to operational disruptions or inability to migrate auction parameters effectively.

// Location: SpiceAuction.sol
​
function createAuction(address spiceToken, string memory name) external override onlyElevatedAccess returns (address) {
if (spiceToken == address(0)) { revert CommonEventsAndErrors.InvalidAddress(); }
if (spiceToken == templeGold) { revert CommonEventsAndErrors.InvalidParam(); }
SpiceAuction spiceAuction = new SpiceAuction(templeGold, spiceToken, daoExecutor, name);
bytes32 pairId = _getPairHash(spiceToken);
@> /// @dev not checking pair address exists to allow overwrite in case of a migration
@> deployedAuctions[pairId] = address(spiceAuction); // can replace the previous SpiceAuction contract of the same pairId
emit AuctionCreated(pairId, address(spiceAuction));
return address(spiceAuction);
}

Impact

Operational disruptions or inability to migrate auction parameters effectively.

Tools Used

Manual Review

Recommendations

Introduce a migration function in the SpiceAuction contract to facilitate transitions information when the auction for the pair is updated.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.