Fjord Token Staking
Fjord
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Zero Bids Scenario Can Render `claimTokens` Function Unusable

4gontuk

Summary

The FjordAuction contract has a potential issue where, if the auction ends with zero bids, the claimTokens function becomes unusable. This is because the multiplier is never set in such a scenario, which is essential for calculating the claimable tokens.

Vulnerability Details

The FjordAuction contract is designed to allow users to bid using FjordPoints and claim auction tokens based on their bids. The auctionEnd function finalizes the auction and calculates the multiplier used to determine the number of auction tokens claimable per FjordPoint bid.

Relevant components:

  • FjordAuction::auctionEnd(): Ends the auction and calculates the multiplier.

  • FjordAuction::claimTokens(): Allows users to claim their auction tokens based on their bids and the multiplier.

When the auction ends with zero bids (totalBids == 0), the auctionEnd function transfers all auction tokens to the owner and exits early without setting the multiplier. This causes the claimTokens function to fail because it relies on the multiplier to calculate the claimable tokens.

function auctionEnd() external {
if (block.timestamp < auctionEndTime) {
revert AuctionNotYetEnded();
}
if (ended) {
revert AuctionEndAlreadyCalled();
}
​
ended = true;
emit AuctionEnded(totalBids, totalTokens);
​
if (totalBids == 0) {
auctionToken.transfer(owner, totalTokens);
return;
}
​
multiplier = totalTokens.mul(PRECISION_18).div(totalBids);
​
// Burn the FjordPoints held by the contract
uint256 pointsToBurn = fjordPoints.balanceOf(address(this));
fjordPoints.burn(pointsToBurn);
}
function claimTokens() external {
if (!ended) {
revert AuctionNotYetEnded();
}
​
uint256 userBids = bids[msg.sender];
if (userBids == 0) {
revert NoTokensToClaim();
}
​
uint256 claimable = userBids.mul(multiplier).div(PRECISION_18);
bids[msg.sender] = 0;
​
auctionToken.transfer(msg.sender, claimable);
emit TokensClaimed(msg.sender, claimable);
}

In the zero-bid scenario, the multiplier is never set, causing the claimTokens function to revert when it attempts to calculate the claimable tokens.

Impact

The claimTokens function becomes unusable in a zero-bid scenario, preventing users from claiming their tokens. This can lead to a loss of trust in the auction system and potential financial loss if users are unable to claim their tokens.

Proof of Concept

  1. The auction runs its course but receives no bids (totalBids == 0).

  2. The auctionEnd() function is called.

  3. The contract transfers all tokens to the owner and exits early without setting the multiplier.

  4. A user attempts to call claimTokens().

  5. The claimTokens() function reverts because multiplier is not set, making it impossible to calculate the claimable tokens.

Tools Used

Manual review

Recommendation

Add a check in the claimTokens function to revert if totalBids is zero, ensuring that the function does not proceed in a zero-bid scenario.

Updates

Lead Judging Commences

inallhonesty Lead Judge
about 1 year ago
inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.