Fjord Token Staking
Fjord
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Owner of auctions created through AuctionFactory is AuctionFactory itself, meaning auction tokens are stuck when no bids are made.

rajko_z

Summary

When a new FjordAuction is created, owner is set to msg.sender . When creating auctions through AuctionFactory, owner will be the factory itself. If no bids are made during the time of the auction, calling auctionEnd will transfer all auction tokens to the factory, causing them to be stuck in the contract.

Vulnerability Details

Proof of concept

Add following test to the auction.t.sol:

function testStuckAuctionTokensInsideFactoryWhenNoBidsAreMade() public {
AuctionFactory factory = new AuctionFactory(address(fjordPoints));
address factoryOwner = factory.owner();
​
// auction creation parameters
uint256 testBiddingTime = 1 days;
uint256 testTotalTokens = 1000 ether;
bytes32 testSalt = keccak256(abi.encodePacked(msg.sender, block.timestamp));
​
// topUp the factory owner with auction tokens
deal(address(auctionToken), factoryOwner, testTotalTokens);
​
// impersonate the factory owner
vm.prank(factoryOwner);
​
// approve the factory to spend the auction tokens on behalf of the owner
auctionToken.approve(address(factory), testTotalTokens);
​
// start listening for logs
vm.recordLogs();
​
// create an auction
factory.createAuction(address(auctionToken), testBiddingTime, testTotalTokens, testSalt);
​
// parse auction created log
Vm.Log[] memory logs = vm.getRecordedLogs();
Vm.Log memory log = logs[logs.length - 1];
bytes32 auctionCreatedTopic = log.topics[log.topics.length - 1];
address createdAuctionAddr = address(uint160(uint256(auctionCreatedTopic)));
​
// make sure new auction has the right amount of tokens
uint256 auctionTokensInsideAuction = auctionToken.balanceOf(createdAuctionAddr);
assertEq(auctionTokensInsideAuction, testTotalTokens);
​
// make sure the owner of the auction is the factory itself
address auctionOwner = FjordAuction(createdAuctionAddr).owner();
assertEq(auctionOwner, address(factory));
​
// pass the bidding time
vm.warp(block.timestamp + testBiddingTime + 1);
​
// get the amount of auction tokens inside the factory before the auction ends
uint256 factoryAuctionTokensBefore = auctionToken.balanceOf(address(factory));
​
// end auction without any bids
FjordAuction(createdAuctionAddr).auctionEnd();
​
// get the amount of auction tokens inside the factory after the auction ends
uint256 factoryAuctionTokensAfter = auctionToken.balanceOf(address(factory));
​
// show that the auction tokens are stuck inside the factory
assertEq(factoryAuctionTokensAfter - factoryAuctionTokensBefore, testTotalTokens);
}

Impact

Auction tokens are stuck inside AuctionFactory.

Tools Used

Manual review.

Recommendations

Consider adding owner as constructor parameter inside FjordAuction contract.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

If no bids are placed during the auction, the `auctionToken` will be permanently locked within the `AuctionFactory`

An auction with 0 bids will get the `totalTokens` stuck inside the contract. Impact: High - Tokens are forever lost Likelihood - Low - Super small chances of happening, but not impossible

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.