Fjord Token Staking
Fjord
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Loss of auction tokens in the event zero bids are submitted.

dic0de

Summary

The FjordAuctioncontracts are deployed from the FjordAuctionFactorycontract via the createAuctionfunction here: https://github.com/Cyfrin/2024-08-fjord/blob/0312fa9dca29fa7ed9fc432fdcd05545b736575d/src/FjordAuctionFactory.sol#L52-L66

Then the auction creater transfers the auction tokens to the new auction contract as seen below in the function.

IERC20(auctionToken).transferFrom(msg.sender, auctionAddress, totalTokens);`

The FjordAuctioncontract is initialized as ```

​
constructor(
address _fjordPoints,
address _auctionToken,
uint256 _biddingTime,
uint256 _totalTokens
) {
if (_fjordPoints == address(0)) {
revert InvalidFjordPointsAddress();
}
if (_auctionToken == address(0)) {
revert InvalidAuctionTokenAddress();
}
fjordPoints = ERC20Burnable(_fjordPoints);
auctionToken = IERC20(_auctionToken);
owner = msg.sender; //@audit owner is the Factory Contract
auctionEndTime = block.timestamp.add(_biddingTime); //@audit starts immediately.
totalTokens = _totalTokens;
}
​

as seen here: https://github.com/Cyfrin/2024-08-fjord/blob/0312fa9dca29fa7ed9fc432fdcd05545b736575d/src/FjordAuction.sol#L134

Interestingly, the FjordAuctioncontract sets the msg.senderas the owneras `

owner = msg.sender;`

This effectively ensures that the FjordAuctionFactorycontract is the ownerof the newly deployed auction contracts.

Now, in the event an auction ends and auctionEndfunction is called and there is no bids in the auction such that totalBids == 0then the auction tokens initialized in the auction contract is sent to the owneraddress which is the FjordAuctionFactorycontract as seen here: https://github.com/Cyfrin/2024-08-fjord/blob/0312fa9dca29fa7ed9fc432fdcd05545b736575d/src/FjordAuction.sol#L193

The FjordAuctionFactorycontract on the other hand has no mechanism to withdraw any tokens sent to it. This effectively locks these auction tokens sent to the factory contract forever.

Vulnerability Details

Impact

In auctions where zero bids are submitted, the auction tokens will be locked in the factory contract with no mechanism to withdraw it.

Tools Used

Recommendations

Consider implementing a withdraw mechanism in the Factory contract to withdraw tokens.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

If no bids are placed during the auction, the `auctionToken` will be permanently locked within the `AuctionFactory`

An auction with 0 bids will get the `totalTokens` stuck inside the contract. Impact: High - Tokens are forever lost Likelihood - Low - Super small chances of happening, but not impossible

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.