Fjord Token Staking
Fjord
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Permanent loss of `FjordTokens` paid for auction if there are no bidders.

alqaqa

Summary

FjordTokens amount paid for the auction is sent to the FjordAuctionFactory if no bidders, and there is no way to get them back.

Vulnerability Details

We are using FjordAuctionFactory to create auctions, where the owner of the FjordAuctionFactory is the one who can create auctions.

Since the Factory is the contract that deploys new auctions, the msg.sender in the constructor of the new FjordAuction contract created is the address of the FjordAuctionFactory.

FjordAuctionFactory.sol#L58-L60

function createAuction( ... ) external onlyOwner {
@> address auctionAddress = address(
new FjordAuction{ salt: salt }(fjordPoints, auctionToken, biddingTime, totalTokens)
);
​
...
}

This will result in creating new FjordAuction, and when creating new Auction we are setting the owner into msg.sender, i.e the owner of that specific auction now is the FjordAuctionFactory

FjordAuction.sol#L134

constructor( ... ) {
...
@> owner = msg.sender;
...
}

Now if there are no Bidders for that auction we are sending auctionToken (Fjord token) back to the owner, which is the FjordAuctionFactory.

FjordAuction.sol#L192-L195

function auctionEnd() external {
...
if (totalBids == 0) {
@> auctionToken.transfer(owner, totalTokens);
return;
}
...
}

Now these tokens that are returned back will get lost forever, as there is no possible way to transfer them from FjordAuctionFactory.

FjordAuctionFactory doesn't implement any function that allows the Factory owner to take these tokens. so this will result in Fjord tokens getting stuck in the factory contact.

Proof of Concept

  • A new Auction is about to start.

  • Factory owner created the auction.

  • Auction owner is the Factory contract.

  • Auction ends with no bidders.

  • Ending the auction by calling auctionEnd().

  • Transferring tokens back to the Auction owner, which is the Factory contract.

  • Permanent stuck of tokens in Factory contract and no one will be able to recover them back.

Impact

Permanent lock/freeze of funds.

Tools Used

Manual Review

Recommendations

Implement a function to recover tokens from the Factory and sending them back to the Factory owner.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

If no bids are placed during the auction, the `auctionToken` will be permanently locked within the `AuctionFactory`

An auction with 0 bids will get the `totalTokens` stuck inside the contract. Impact: High - Tokens are forever lost Likelihood - Low - Super small chances of happening, but not impossible

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.