Fjord Token Staking
Fjord
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Bid and unbid both allow amount 0 which can lead to DOS or wasting gas

mangocola

Summary

Bid and Unbid function of FjordAuction.sol allows bidding and unbidding with an amount of 0, which may lead to DOS or gas wasting.

Vulnerability Details

/**
* @notice Places a bid in the auction.
* @param amount The amount of FjordPoints to bid.
*/
function bid(uint256 amount) external {
if (block.timestamp > auctionEndTime) {
revert AuctionAlreadyEnded();
}
​
bids[msg.sender] = bids[msg.sender].add(amount);
totalBids = totalBids.add(amount);
​
fjordPoints.transferFrom(msg.sender, address(this), amount);
emit BidAdded(msg.sender, amount);
}

Function bid does not check if the bid amount is 0, this allows a user to bid and more importantly transferFrom with 0 amount. Calling transferFrom with an amount of 0 still incurs gas costs, even though no tokens are transferred.

Emitting the BidAdded event with an amount of 0 also consumes gas.

If a malicious user can thus call Bid many times with just amount 0 this would be costly and also might cause a DOS.

/**
* @notice Allows users to withdraw part or all of their bids before the auction ends.
* @param amount The amount of FjordPoints to withdraw.
*/
function unbid(uint256 amount) external {
if (block.timestamp > auctionEndTime) {
revert AuctionAlreadyEnded();
}
​
uint256 userBids = bids[msg.sender];
if (userBids == 0) {
revert NoBidsToWithdraw();
}
if (amount > userBids) {
revert InvalidUnbidAmount();
}
​
bids[msg.sender] = bids[msg.sender].sub(amount);
totalBids = totalBids.sub(amount);
fjordPoints.transfer(msg.sender, amount);
emit BidWithdrawn(msg.sender, amount);
}

Same issue can be seen from here although it checks if userBids is equal to 0 it does not check if amount is 0. This means an attacker can bid a very small amount (miniumum bid) and then call unbid many times to cause a DOS or waste gas.

Impact

Medium

Tools Used

Source code review

Recommendations

Add a check to make sure cannot bid amount 0 and cannot unbid amount 0. if (amount == 0) {
revert InvalidBidAmount();
}

if (amount == 0) {
revert InvalidBidAmount();
}
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.