Fjord Token Staking

Summary

Overflow while calculating multiplier variable in FjordAuction.sol::auctionEnd()

Vulnerability Details

https://github.com/Cyfrin/2024-08-fjord/blob/main/src/FjordAuction.sol#L181

Possibility of overflow/revert when calling the auctionEnd function.
The mutiplier variable may overflow when multiplying totalTokens with PRECISION_18 if totaltokens is very high.

Explainations

In Solidity 0.8.21, overflows are automatically detected, and the operation will fail (revert).

In the auctionEnd() function, the max limit of totalTokens is the max of uint256.
However, there is a risk of overflow on this line of code:

Calculation details

The multiplication occurs first:

To avoid overflow, the result of this multiplication must be less than because uint256 can hold a maximum value of

Therefore, the maximum value of must be less than $ 2^{256}$

To avoid overflow:

Isolating totalTokens:

Let's calculate this value:

So:

Final Result:

If totalTokens is greater than or equal to this approximate value of 1.1579e59, the auctionEnd() function will revert.

Impact

The auctionEnd() function cannot be used, as it will revert on each call.
Total loss of all auctionTokens contained in the FjordAuction contract, as users cannot use claimTokens() because the auction can’t be ended.

Tools Used

Manual Verification

Recommendations

https://github.com/Cyfrin/2024-08-fjord/blob/main/src/FjordAuctionFactory.sol#L52

Use a condition to check that totalTokens is not too high when creating an auction.