Fjord Token Staking

Relevant GitHub Links

unbid

Summary

The FjordAuction contract's lack of restrictions on the unbid function can be exploited by attackers to manipulate auction outcomes and gain assets at lower than expected prices.

Vulnerability Details

In the FjordAuction contract, bidders can initially bid a large number of points to artificially inflate the auction price. This tactic can deter other potential bidders. At the last moment, just as the auction conditions are met for ending, the attacker can call unbid followed by auctionEnd, acquiring the auctioned tokens for a minimal cost.

Proof of Concept (POC)
By performing a last-moment unbid of a substantial amount of points, an attacker can acquire significant auction tokens at the cost of just 1 point.

Add the following test to test/unit/auction.t.sol:

Impact

Due to Solidity's truncation characteristics, when the auction price is sufficiently high, other users may be entirely unable to obtain the auctioned tokens, leading them to unbid their own tokens. This increases the attacker's profit margin further. With no buffer period for unbid, an attacker possessing a large number of points can exploit this to repeatedly attack various auctions.

Tools Used

Manual Review

Recommendations

Consider implementing a buffer period for unbid actions. During this buffer period, the points will remain locked in the contract and will not participate in the bidding. Users can retrieve their points after the buffer period or the auction's conclusion. Additionally, prohibit unbid actions a short time before the auction ends to prevent any last-moment tampering, ensuring the auction price is accurately represented toward its conclusion.