Fjord Token Staking

Summary

https://github.com/Cyfrin/2024-08-fjord/blob/main/src/FjordAuctionFactory.sol

The use of create2 for auction contract creation exposes the contract to front-running risks, where a malicious actor could precompute the auction address and deploy their own contract at that address before the AuctionFactory does.

Vulnerability Details

The create2 opcode generates a deterministic address based on the provided salt, making it possible for an attacker to front-run the auction creation by deploying their contract at the precomputed address before the factory can deploy the intended auction contract.

Impact

If an attacker successfully front-runs the deployment, it could prevent the auction from being created, causing disruption in the auction process and potentially locking funds or causing other issues.

Tools Used

Manual Review

Recommendations

Consider using a more secure method for generating the salt (e.g., incorporating a nonce or secret value) to reduce predictability and mitigate the risk of front-running.