TempleGold

TempleDAO
Foundry
25,000 USDC
View results
Submission Details
Severity: medium
Invalid

In `EpochLib` function `hasStarted` have inaccurate check and does not accurately represent it's intention and purpose

Summary

In EpochLib function hasStarted have inaccurate check and does not accurately represent it's intention and purpose

Vulnerability Details

The purpose of hasStarted function is to show that epoch was started and but not that Auction is active.
The current design looks like this:
https://github.com/Cyfrin/2024-07-templegold/blob/57a3e597e9199f9e9e0c26aab2123332eb19cc28/protocol/contracts/templegold/EpochLib.sol#L17

function hasStarted(IAuctionBase.EpochInfo storage info) internal view returns (bool) {
return info.startTime > 0 && block.timestamp >= info.startTime;
}

If we check how startTime is updated it looks like this:
DaiGoldAuction - https://github.com/Cyfrin/2024-07-templegold/blob/57a3e597e9199f9e9e0c26aab2123332eb19cc28/protocol/contracts/templegold/DaiGoldAuction.sol#L122

uint128 startTime = info.startTime = uint128(block.timestamp) + config.auctionStartCooldown;

SpiceAudtion - https://github.com/Cyfrin/2024-07-templegold/blob/57a3e597e9199f9e9e0c26aab2123332eb19cc28/protocol/contracts/templegold/SpiceAuction.sol#L169

uint128 startTime = info.startTime = uint128(block.timestamp) + config.startCooldown;

As we can see the startTime is sum of block.timestamp and coldown amount when auction start.
The issue is that the function would return false in cases where it is important to know if auctions is started but starting cooldown is not reached yet which would make auctions active but the deposits not available.
The example where this should be useful and important is in SpiceAuction::removeAuctionConfig where it should be able to delete current epoch if auction is started but cooldown not reached as we can see here:
https://github.com/Cyfrin/2024-07-templegold/blob/57a3e597e9199f9e9e0c26aab2123332eb19cc28/protocol/contracts/templegold/SpiceAuction.sol#L116

Impact

Inaccurate results from functions could prevent critical functions or protocol to work

Tools Used

Manual Review

Recommendations

Make sure that block.timestamp is not bigger than startTime because if it is it will come in isActive time frame making the function hasStarted inaccurate and lose it's purpose.

function hasStarted(IAuctionBase.EpochInfo storage info) internal view returns (bool) {
- return info.startTime > 0 && block.timestamp >= info.startTime;
+ return info.startTime > 0 && block.timestamp <= info.startTime;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.