Summary

see below

Vulnerability Details

In the FjordAuction contract, the auctionEnd() function is responsible for terminating the auction once the specified auction end time (auctionEndTime) has been reached. This function sets the ended flag to true, indicating that the auction has concluded, and it prevents any further bids from being placed. The relevant part of the code is as follows:

However, there is no restriction on who can call the auctionEnd() function, meaning any user—including a malicious one—can call this function as soon as the current timestamp surpasses the auctionEndTime. This presents a critical issue because an attacker can deliberately end the auction prematurely before any legitimate users have the opportunity to place their bids.

Once the auctionEnd() function is called and the auction is marked as ended, any subsequent calls to the bid() function will fail, reverting with the AuctionAlreadyEnded() error:

As a result, this can lead to a situation where the auction ends with little or no participation, and legitimate users are denied the chance to place their bids.

Impact

If an attacker calls the auctionEnd() function prematurely, they can effectively terminate the auction before any legitimate bids have been placed, causing the auction to conclude with no participation. This will prevent users from bidding and disrupt the auction process, leading to potential financial losses for both bidders and the auction organizer.

Tools Used

Manual

Recommendations

The auctionEnd() function should be restricted so that only the auction owner can call it, or alternatively, a time buffer could be introduced that ensures a minimum participation period before the auction can be ended.