Fjord Token Staking
Fjord
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Auction with 0 bids will transfers funds to Auction Factory instead of Auction Factory owner, resulting in locking of funds permanently

ravikiranweb3

Summary

AuctionFactory::createAuction() deploys the Auction contracts and hence the owner of Auction contract is AuctionFactory.

Vulnerability Details

The owner for Auction contract is AuctionFactory as in the constructor of Auction , msg.sender is assigned as the owner.

constructor(
address _fjordPoints,
address _auctionToken,
uint256 _biddingTime,
uint256 _totalTokens
) {
...
--> owner = msg.sender;
...
}

If for a particular auction, there are no bids received, then at the time end of auction, the funds are transferred back to the owner.

function auctionEnd() external {
....
​
if (totalBids == 0) {
--> auctionToken.transfer(owner, totalTokens);
return;
}
...
}

hence, the funds are transferred back to AuctionFactory contract, instead of the owner of the AuctionFactory contract.

AuctionFactory contract does not have a way to with draw these locked tokens.

Impact

The funds will be permanently locked incase a particular Auction does not receive bids by the time the auction ends.

Tools Used

Manual review

Recommendations

The funds should be returned back to the owner of AuctionFactory contract.
Revise the function as below.

function auctionEnd() external {
if (block.timestamp < auctionEndTime) {
revert AuctionNotYetEnded();
}
if (ended) {
revert AuctionEndAlreadyCalled();
}
​
ended = true;
emit AuctionEnded(totalBids, totalTokens);
​
if (totalBids == 0) {
- auctionToken.transfer(owner, totalTokens);
+ auctionToken.transfer(owner.owner(), totalTokens);
return;
}
​
multiplier = totalTokens.mul(PRECISION_18).div(totalBids);
​
// Burn the FjordPoints held by the contract
uint256 pointsToBurn = fjordPoints.balanceOf(address(this));
fjordPoints.burn(pointsToBurn);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

If no bids are placed during the auction, the `auctionToken` will be permanently locked within the `AuctionFactory`

An auction with 0 bids will get the `totalTokens` stuck inside the contract. Impact: High - Tokens are forever lost Likelihood - Low - Super small chances of happening, but not impossible

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.