TempleGold

Summary

Since users can find a specific SpiceAuction contract address for a Spice-TGLD auction via the SpiceAuctionFactory::findAuctionForSpiceToken function, users can, with the intention to place a bid at this address, send bidToken to the auction address without calling SpiceAuction::bid function.

Impact

This can cause permanent loss of token funds, and reward token, for token depositors as they won't be recorded as bidders.

Tools Used

Manual Review

Recommendations

Implement receive / fallback functions that calls SpiceAuction::bid to handle a case where users, malicious or not, deposit bid token directly to SpiceAuction contract.