Fjord Token Staking
Fjord
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Enhance Validation in createAuction Function

tpiliposian

Summary

The AuctionFactory contract's createAuction function lacks sufficient validation for its input parameters. This oversight could lead to the creation of auctions with invalid configurations or transfer of tokens to incorrect addresses. Implementing basic validation checks for parameters such as biddingTime, and totalTokens is crucial to prevent unintended behavior and ensure the integrity of the auction creation process.

Vulnerability Details

The createAuction function in the AuctionFactory contract currently lacks checks for the following parameters:

function createAuction(
address auctionToken,
uint256 biddingTime,
uint256 totalTokens,
bytes32 salt
) external onlyOwner {
​
address auctionAddress = address(
new FjordAuction{ salt: salt }(fjordPoints, auctionToken, biddingTime, totalTokens)
);
​
// Transfer the auction tokens from the msg.sender to the new auction contract
IERC20(auctionToken).transferFrom(msg.sender, auctionAddress, totalTokens);
​
emit AuctionCreated(auctionAddress);
}

On the Auction side there are zero address checks in place, but that is not enough:

constructor(
address _fjordPoints,
address _auctionToken,
uint256 _biddingTime,
uint256 _totalTokens
) {
if (_fjordPoints == address(0)) {
revert InvalidFjordPointsAddress();
}
if (_auctionToken == address(0)) {
revert InvalidAuctionTokenAddress();
}
fjordPoints = ERC20Burnable(_fjordPoints);
auctionToken = IERC20(_auctionToken);
owner = msg.sender;
auctionEndTime = block.timestamp.add(_biddingTime);
totalTokens = _totalTokens;
}

Impact

As the createAuction function transfers totalTokens to the auction contract, it is crucial to have these checks in place otherwise the funds will be lost.

Tools Used

Manual review.

Recommendations

Add appropriate checks for biddingTime and totalTokens in the createAuction() function.

Updates

Lead Judging Commences

inallhonesty Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.