Fjord Token Staking
Fjord
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Irretrievable Tokens in AuctionFactory after Zero Bids

galturok

Summary

The AuctionFactory contract creates instances of the FjordAuction contract. When an auction is ended with zero bids, the auction tokens are transferred back to the owner of the auction contract. However, the AuctionFactory contract itself becomes the owner of each new FjordAuction instance, and it does not have any functions to handle or retrieve these tokens. As a result, any auction tokens transferred back when there are no bids get permanently stuck in the AuctionFactory contract.

Vulnerability Details

The AuctionFactory contract is responsible for creating new instances of the FjordAuction contract. When a new auction is created, the AuctionFactory contract sets itself as the owner of the FjordAuction instance. Here’s the relevant section of the factory contract:

https://github.com/Cyfrin/2024-08-fjord/blob/0312fa9dca29fa7ed9fc432fdcd05545b736575d/src/FjordAuctionFactory.sol#L58C9-L60C11

address auctionAddress = address(
new FjordAuction{ salt: salt }(fjordPoints, auctionToken, biddingTime, totalTokens)
);
​

In the FjordAuction contract, the owner is set during initialization to the address that created the auction, i.e., the AuctionFactory:

https://github.com/Cyfrin/2024-08-fjord/blob/0312fa9dca29fa7ed9fc432fdcd05545b736575d/src/FjordAuction.sol#L134

owner = msg.sender;
​

When an auction ends with zero bids, the auction tokens are supposed to be returned to the owner, which is the AuctionFactory contract:

https://github.com/Cyfrin/2024-08-fjord/blob/0312fa9dca29fa7ed9fc432fdcd05545b736575d/src/FjordAuction.sol#L192C9-L195C10

if (totalBids == 0) {
auctionToken.transfer(owner, totalTokens);
return;
}
​

However, the AuctionFactory contract lacks any methods to manage or withdraw these tokens once they are transferred back to it. Consequently, the auction tokens are locked within the AuctionFactory, leading to a scenario where these tokens become irretrievable and effectively lost.

Impact

Tokens transferred back to the AuctionFactory address in zero-bid auctions remain stuck and unrecoverable.

Tools Used

Foundry

Recommendations

AuctionFactory: Add functions for the owner to retrieve tokens from the AuctionFactory contract. This would allow the recovery of any tokens that were returned due to zero bids.

function withdrawTokens(address token, uint256 amount) external onlyOwner {
IERC20(token).transfer(owner, amount);
}
​
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

If no bids are placed during the auction, the `auctionToken` will be permanently locked within the `AuctionFactory`

An auction with 0 bids will get the `totalTokens` stuck inside the contract. Impact: High - Tokens are forever lost Likelihood - Low - Super small chances of happening, but not impossible

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.