TempleGold
TempleDAO
Foundry
25,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

[M-1] SpiceAuction::removeAuctionConfig reverts for First ever Auction

binary

github link

https://github.com/Cyfrin/2024-07-templegold/blob/57a3e597e9199f9e9e0c26aab2123332eb19cc28/protocol/contracts/templegold/SpiceAuction.sol#L113

summary

The first-ever created Auction Config in SpiceAuction.sol will revert if an attempt is made to remove it using the remove auction config in SpiceAuction::removeAuctionConfig.

Vulnerability Details

SpiceAuction::removeAuctionConfig, have a validation that reverts the whole function when trying to remove the first ever auction which is if (info.startTime == 0) revert InvalidConfigOperation , this means that the removeAuctionConfig will revert in line 113 without completing the rest of function due to this validation, remember this only happens in the first ever auction in the SpiceAuction contract

Impact:

If the daoExecutor happens for any reason want to remove the first auction config, it will throw an error, with this reason the contract becomes useless because the AuctionConfig cannot be removed. The inability to remove the first auction config without redeploying the contract significantly hinders the functionality and flexibility of the contract.

Proof of Concept:

Below is the removeAuctionConfig() function highlighting the problematic check:

function removeAuctionConfig() external override onlyDAOExecutor {
/// only delete latest epoch if auction is not started
uint256 id = _currentEpochId;
​
EpochInfo storage info = epochs[id];
@> if (info.startTime == 0) revert InvalidConfigOperation();
// Cannot reset an ongoing auction
if (info.isActive()) revert InvalidConfigOperation();
​
bool configSetButAuctionStartNotCalled = auctionConfigs[id + 1].duration > 0;
if (!configSetButAuctionStartNotCalled) {
if (info.hasEnded()) revert AuctionEnded();
​
delete auctionConfigs[id];
delete epochs[id];
_currentEpochId = id - 1;
emit AuctionConfigRemoved(id, _currentEpochId);
} else {
id += 1;
delete auctionConfigs[id];
emit AuctionConfigRemoved(id, _currentEpochId);
}
}
​

Recommended Mitigation:

To address this issue, it is recommended to update the function logic to allow the removal of the first auction config. This can be achieved by ensuring that the check for info.startTime is appropriately handled for the initial epoch:

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

`removeAuctionConfig` can't remove the first added `SpiceAuctionConfig` which in the end leads to inability to recover the funds associated to that auction

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.