Fjord Token Staking
Fjord
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

The address created by Create2 is not checked to see if it is a non-zero address.

acai

Summary

A high-severity vulnerability has been identified in the AuctionFactory contract's createAuction function. The function fails to verify that the address created using the create2 opcode is not the zero address. This oversight could potentially lead to the loss of tokens if a zero address is inadvertently generated.

Vulnerability Details

The vulnerability is located in the createAuction function of the AuctionFactory contract:

function createAuction(
address auctionToken,
uint256 biddingTime,
uint256 totalTokens,
bytes32 salt
) external onlyOwner {
address auctionAddress = address(
new FjordAuction{ salt: salt }(fjordPoints, auctionToken, biddingTime, totalTokens)
);
​
IERC20(auctionToken).transferFrom(msg.sender, auctionAddress, totalTokens);
​
emit AuctionCreated(auctionAddress);
}

The function uses the create2 opcode to deploy a new FjordAuction contract. However, it does not check if the resulting auctionAddress is the zero address.

Immediately after creating the contract, the function attempts to transfer tokens to the newly created address:

IERC20(auctionToken).transferFrom(msg.sender, auctionAddress, totalTokens);

If auctionAddress were to be the zero address, this transfer would result in the permanent loss of the tokens.

Impact

The impact of this vulnerability is potentially severe:

  1. If a zero address is generated, it would result in the immediate and irreversible loss of totalTokens amount of auctionToken.

  2. The created auction would be non-functional, as it would not have a valid address to interact with.

While the probability of this occurring is extremely low due to the nature of create2, the potential impact is high enough to warrant addressing this vulnerability.

Tools Used

Manual

Recommendations

To mitigate this vulnerability, we recommend implementing a check immediately after creating the auction contract:

function createAuction(
address auctionToken,
uint256 biddingTime,
uint256 totalTokens,
bytes32 salt
) external onlyOwner {
address auctionAddress = address(
new FjordAuction{ salt: salt }(fjordPoints, auctionToken, biddingTime, totalTokens)
);
​
if (auctionAddress == address(0)) revert AuctionCreationFailed();
​
IERC20(auctionToken).transferFrom(msg.sender, auctionAddress, totalTokens);
​
emit AuctionCreated(auctionAddress);
}

This check ensures that if, a zero address is generated, the function will revert before any token transfer occurs.

Reference：https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/utils/Create2.sol

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.