Fjord Token Staking
Fjord
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Tokens Stuck in AuctionFactory on Zero Bids

aksoy

Summary

if no bids are placed during an auction, the auction tokens are transferred back to the owner of the auction, which is the factory contract. However, the factory contract lacks any logic to recover or transfer these tokens.

Vulnerability Details

The createAuction function in the factory contract creates a new auction contract and transfers the specified totalTokens from the msg.sender to the new auction contract. Since deployer is factory auction owner is assigned as AuctionFactory.

constructor(
address _fjordPoints,
address _auctionToken,
uint256 _biddingTime,
uint256 _totalTokens
) {
if (_fjordPoints == address(0)) {
revert InvalidFjordPointsAddress();
}
if (_auctionToken == address(0)) {
revert InvalidAuctionTokenAddress();
}
fjordPoints = ERC20Burnable(_fjordPoints);
auctionToken = IERC20(_auctionToken);
owner = msg.sender;

In the auctionEnd function of the auction contract, the tokens are supposed to be returned to the owner (the factory contract) if no bids are placed. However, the factory contract does not have any function to handle these tokens once they are returned. As a result, these tokens are effectively locked and cannot be retrieved.

if (totalBids == 0) {
//@audit tokens sent to factory
auctionToken.transfer(owner, totalTokens);
return;
}

https://github.com/Cyfrin/2024-08-fjord/blob/0312fa9dca29fa7ed9fc432fdcd05545b736575d/src/FjordAuction.sol#L192

Impact

Permanent loss of the auction tokens when no bids are placed. Any tokens returned to the factory contract remain stuck there.

Tools Used

Manual

Recommendations

Change auction owner from ActionFactory to a different contract tor user address

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

If no bids are placed during the auction, the `auctionToken` will be permanently locked within the `AuctionFactory`

An auction with 0 bids will get the `totalTokens` stuck inside the contract. Impact: High - Tokens are forever lost Likelihood - Low - Super small chances of happening, but not impossible

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.