Submission Details
Severity:
Missing Validation for Auction End Time in Constructor
Vulnerability Details
https://github.com/Cyfrin/2024-08-fjord/blob/0312fa9dca29fa7ed9fc432fdcd05545b736575d/src/FjordAuction.sol#L135
Impact
In the constructor, there is no check/validation for auction end time. As a result, auction owners can mistakenly or maliciously create auctions with an end time that may be unreasonably far in the future.
Tools Used
Manual Review
Recommendations
Include a MAXIMUM_ENDTIME variable. In the constructor, validate that biddingtime is not greater than MAXIMUM_ENDTIME
Example
+ uint256 public constant MAXIMUM_ENDTIME = 2 weeks
constructor
(
address _fjordPoints,
address _auctionToken,
uint256 _biddingTime,
uint256 _totalTokens)
{
.
.
.
+ require(_biddingTime > 0, "Bidding time must be greater than zero.");
+ require(_biddingTime <= MAXIMUM_ENDTIME, "Bidding time exceeds maximum allowed duration.");
auctionEndTime = block.timestamp.add(_biddingTime);
totalTokens = _totalTokens;
}
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
66230
USDC / LOC
16,000 USDC
2,500 USDC
1,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.