Fjord Token Staking

Summary

The current FjordAuction.sol contract allows users to place and withdraw bids, but it does not provide a mechanism to return the bids if the auctionToken cannot be transferred or claimed after the auction ends. This oversight could lead to an unfair loss of users' bids/points if the auction token is misconfigured or encounters an unexpected issue.

Vulnerability Details

The FjordAuction.solcontract allows users to place bids using FjordPoints tokens. At the end of the auction, users can claim their proportional share of the auctionToken.

If the auctionToken is misconfigured or cannot be transferred for any reason - for example, the auctionToken might become non-transferable due to external factors (e.g., contract upgrades, security incidents, paused transfers or other unforseen issues) - users will be unable to retrieve their points bidded. The contract currently lacks a mechanism that would return the user' bids after the auction ends if they cannot receive the reward tokens. Further, all their points bidded would have already been burnt at the point where FjordAuction::auctionEnd is called:

https://github.com/Cyfrin/2024-08-fjord/blob/0312fa9dca29fa7ed9fc432fdcd05545b736575d/src/FjordAuction.sol#L178-L202

Impact

Without a mechanism to handle failed auctionToken transfers, users who have bidded their FjordPoints would permanently lose their points and rewards, if they cannot receive the auctionToken.

Tools Used

Manual review.

Recommendations

Include a fallback mechanism in the FjordAuctio::claimTokens that handles auctionToken transfer failures, potentially by reverting to a safe state where users can reclaim their FjordPoints (points should be burnt here instead of burnt already at FjordAuction::auctionEnd).