TempleGold
TempleDAO
Foundry
25,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

[H-2] SpiceAuction::recoverTokens reverted while trying to recover first ever spice auction token

binary

Summary

The recoverTokens() function in SpiceAuction reverts when attempting to recover tokens from the first-ever spice auction. This issue prevents the daoExecutor from recovering tokens, potentially leading to a loss of funds.

Vulnerability Details

The recoverTokens() function is designed to allow the daoExecutor to recover tokens from the contract. However, when attempting to recover tokens from the first-ever spice auction, the function reverts due to a flaw in the logic that handles token recovery. This issue occurs because the initial state does not properly account for the first ever auction, causing the function to fail when it is executed for the first time.

Impact

If the daoExecutor is unable to recover tokens from the first-ever spice auction, it can lead to several issues:

  • Token Lock-up: The tokens intended for recovery may become permanently stuck in the contract.

  • Financial Loss: The inability to recover tokens can result in financial losses for users and the daoExecutor.

  • Contract Usability: The contract's functionality can be compromised, making it unreliable and potentially unusable for its intended purpose.

Proof of Code

  • The following code demonstrates the issue by showing the recoverTokens() function reverting when the daoExecutor attempts to recover tokens from the first-ever spice auction. This test can be added to your spiceAuction.t.sol test file and run with forge test --mt testAuctionTokenCannotBeRecoveredForFirstEverSpiceAuction

function testAuctionTokenCannotBeRecoveredForFirstEverSpiceAuction() public {
address temple = makeAddr("temple");
// set the config
vm.startPrank(daoExecutor);
ISpiceAuction.SpiceAuctionConfig memory _config = _getAuctionConfig();
spice.setAuctionConfig(_config);
​
// userA starts the first auction
vm.startPrank(alice);
vm.warp(block.timestamp + _config.waitPeriod);
IERC20 auctionToken = IERC20(_getAuctionToken(_config.isTempleGoldAuctionToken, daiToken));
dealAdditional(auctionToken, address(spice), 100 ether);
uint256 epoch = spice.currentEpoch();
IAuctionBase.EpochInfo memory epochInfo = spice.getEpochInfo(epoch);
spice.startAuction();
​
epochInfo = spice.getEpochInfo(epoch + 1);
vm.warp(epochInfo.endTime);
​
// daoExecutor tries to recover tokens
vm.startPrank(daoExecutor);
vm.expectRevert();
spice.recoverToken(address(spice), address(temple), 1 ether);
}

  • the test passes showing that it was expecting a revert in the last line of the code

Recommended Mitigation

To fix this issue, update the logic in the recoverToken() function to correctly handle the initial state of the first-ever spice auction. Ensure that the function can account for the first auction and recover tokens as expected.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

`removeAuctionConfig` can't remove the first added `SpiceAuctionConfig` which in the end leads to inability to recover the funds associated to that auction

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.