Fjord Token Staking

Vulnerability Details

FjordAuction is a type of auction that is used to distribute tokens according to the amount of bids. The more biddings the less auctionTokens received. So as long as bidding is profitable (depositing fjordPoints).

When users see that it is not profitable to pay fjordPoints will end up receiving less amount of auction tokens they see it as a good trade or profitable they will simply not bid or cancel their old bidding.

The problem is that anyone can bid and unbid at anytime, there is no restrictions to unbid even at the last second before auction close, which opens up the possibility for the whales to bid a huge amount of fjordPoints, Making it unprofitable for the bidders, then unbid all the amount and leave just 1 wei of fjordPoint at the end to end up receiving the hole auctionToken amount in the Auction contract without paying (totally unfair distribution).

Proof of Concept

• The auction starts with 100e18 auction tokens.

• The fair price is that 10e18 fjordPoints worth 1e18 auction token.

• Bidding fjord is profitable totalBid is less than 1000e18 fjordPoints.

• Once auction starts a Whale bidded with 10_000e18 fjordPoint.

• Now the auction will give you only 0.1e18 auction token for 10e18 fjordPoints, which is not profitable at all.

• No one bids for that auction.

• few seconds before the auction ends the whale unbid() all his fjordPoints leaving only 1 wei

• The Auction ends and the only bidder is the whale with a bud amount = 1 wei fjordPoint.

• calling auctionEnd()

• multiplier = (totalTokens * 1e18) / totalBids = (100e18 * 1e18) / 1 = 100e36.

• The whale called claimTokens()

• claimable = (userBid * multiplier) / 1e18 = (1 * 100e36) / 1e18 = 100e18 (total auction tokens)

• The Whale will claim all auction tokens by only sending 1 wei fjordPoint

Impact

• Unfair distribution of auction tokens.

• Whales can secure winning the auction and claiming all auctionToken by paying nothing (1 wei).

Tools Used

Manual Review

Recommendations

Implement a time bit extension when calling unbid() where if the whale called unbid() at the last second, the auctionEnd time gets increased by 8 hours for example to let other users notice that and participate in the auction.