Fjord Token Staking
Fjord
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing Zero check in `FjordAuction::bid` Function

wizard

Summary

The bid function doesn't include a check to stop zero-value bids. this would allow users to submit bids with an amount of zero, leading to unnecessary state changes, event emissions, and potential logical inconsistencies within the auction process.

Vulnerability Details

There is no check to ensure that amount is greater than zero. This allows users to call the function with an amount of 0.

function bid(uint256 amount) external {
if (block.timestamp > auctionEndTime) {
revert AuctionAlreadyEnded();
}
​
bids[msg.sender] = bids[msg.sender].add(amount);
totalBids = totalBids.add(amount);
​
fjordPoints.transferFrom(msg.sender, address(this), amount);
emit BidAdded(msg.sender, amount);
}

Impact

  1. Users can call the function with 0 amount, consuming gas and emitting events without contributing to the auction.

  2. Zero or near-zero bids could artificially inflate the number of participants without meaningful contribution.

  3. An attacker could submit many tiny bids to increase gas costs for auctionEnd function for real bidders.

  4. Extremely small bids might lead to dust amounts during token distribution, potentially leaving unclaimed tokens in the contract.

Tools Used

Mannual Review

Recommendations

Implement a minimum bid amount check in the bid function, by defining a constant MINIMUM_BID_AMOUNT value

++ MINIMUM_BID_AMOUNT = // a minimum amount defined by the protocol owner
​
​
​
function bid(uint256 amount) external {
if (block.timestamp > auctionEndTime) {
revert AuctionAlreadyEnded();
}
++ if (amount == 0 || amount < MINIMUM_BID_AMOUNT) {
revert BidTooLow();
}
​
bids[msg.sender] = bids[msg.sender].add(amount);
totalBids = totalBids.add(amount);
​
fjordPoints.transferFrom(msg.sender, address(this), amount);
emit BidAdded(msg.sender, amount);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.