Fjord Token Staking
Fjord
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

`auctionToken` will be lost if `create2` fails and returns `address(0)`

0xnbvc

Vulnerability Details

The FjordAuctionFactory contract uses create2 to deploy new FjordAuction contracts:

FjordAuctionFactory.sol#L58-L60

address auctionAddress = address(
new FjordAuction{ salt: salt }(fjordPoints, auctionToken, biddingTime, totalTokens)
);

It's a well-known issue that create2 can fail if the deployment operation fails and return address(0) if so: https://solodit.xyz/issues/antepoolfactory-does-not-validate-create2-return-addresses-trailofbits-ante-protocol-pdf

The FjordAuctionFactory contract does not check if create2 returns address(0), and sends the auctionToken in the same transaction as the create2 operation:

FjordAuctionFactory.sol#L62-L63

// Transfer the auction tokens from the msg.sender to the new auction contract
IERC20(auctionToken).transferFrom(msg.sender, auctionAddress, totalTokens);

Thus, if create2 fails and returns address(0), the auctionToken will be lost.

Impact

The auctionToken will be lost if create2 fails and returns address(0).

Recommendations

Ensure that create2 returns a non-zero address before sending the auctionToken:

function createAuction(
address auctionToken,
uint256 biddingTime,
uint256 totalTokens,
bytes32 salt
) external onlyOwner {
address auctionAddress = address(
new FjordAuction{ salt: salt }(fjordPoints, auctionToken, biddingTime, totalTokens)
);
​
+ require(auctionAddress != address(0), "Create2 failed");
​
// Transfer the auction tokens from the msg.sender to the new auction contract
IERC20(auctionToken).transferFrom(msg.sender, auctionAddress, totalTokens);
Updates

Lead Judging Commences

inallhonesty Lead Judge
about 1 year ago
inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Appeal created

0xnbvc Submitter
about 1 year ago
inallhonesty Lead Judge
about 1 year ago
inallhonesty Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.