Submission Details
Severity:
Parameter Validation in FjordAuctionFactory:createAuction Function
Summary
The parameters passed to the createAuction function are not validated. This could lead to unintended behaviors, such as the auction being created with zero tokens or an invalid bidding time.
https://github.com/Cyfrin/2024-08-fjord/blob/main/src/FjordAuctionFactory.sol#L52
Tools Used
Manually
Recommendations
Add validations for the auctionToken, biddingTime, and totalTokens parameters to ensure they are within acceptable ranges.
function createAuction(
address auctionToken,
uint256 biddingTime,
uint256 totalTokens,
bytes32 salt
) external onlyOwner {
if (auctionToken == address(0)) revert InvalidAddress();
if (biddingTime == 0) revert InvalidBiddingTime();
if (totalTokens == 0) revert InvalidTotalTokens();
address auctionAddress = address(
new FjordAuction{ salt: salt }(fjordPoints, auctionToken, biddingTime, totalTokens)
);
IERC20(auctionToken).transferFrom(msg.sender, auctionAddress, totalTokens);
emit AuctionCreated(auctionAddress);
}
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
66230
USDC / LOC
16,000 USDC
2,500 USDC
1,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.