Fjord Token Staking
Fjord
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Others users' bids can be Stolen by Reentrancy

silentwalker

Summary

The bid function does not follow the Check-effects-interactions pattern correctly allowing a malicious user to add his bids amount without transferring amount.

Vulnerability Details

Step 1 - A malicious user calls the `bid` function with a malicious contract which will allow them to create many bids without transferring any amount. Thus increasing the number of bids and amount in the bids mapping.

https://github.com/Cyfrin/2024-08-fjord/blob/main/src/FjordAuction.sol#L143-L153

function bid(uint256 amount) external {
if (block.timestamp > auctionEndTime) {
revert AuctionAlreadyEnded();
}
bids[msg.sender] = bids[msg.sender].add(amount);
totalBids = totalBids.add(amount);
//@> fallback fn here//@audit-issue reentrancy --unlimited bids then unbid to get tokens
fjordPoints.transferFrom(msg.sender, address(this), amount);
emit BidAdded(msg.sender, amount); }

Step 2 - The malicious user will call the unbid function to transfer the fjordPoints in the auction.

https://github.com/Cyfrin/2024-08-fjord/blob/main/src/FjordAuction.sol#L159-L176

bids[msg.sender] = bids[msg.sender].sub(amount);
totalBids = totalBids.sub(amount);
fjordPoints.transfer(msg.sender, amount);
emit BidWithdrawn(msg.sender, amount);
}

Impact

Amount bid by other users in an auction will be lost

Tools Used

Manual Review

Recommendations

The simplest reentrancy prevention mechanism is to use a ReentrancyGuard, which allows you to add a modifier, e.g. nonReentrant, to functions that may otherwise be vulnerable or follow the check-effects-interactions pattern as shown below.

function bid(uint256 amount) external {
if (block.timestamp > auctionEndTime) {
revert AuctionAlreadyEnded();
}
+ fjordPoints.transferFrom(msg.sender, address(this), amount);
bids[msg.sender] = bids[msg.sender].add(amount);
totalBids = totalBids.add(amount);
- fjordPoints.transferFrom(msg.sender, address(this), amount);
emit BidAdded(msg.sender, amount);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Lack of quality

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.