Fjord Token Staking
Fjord
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Loss of Tokens Backed from Auction When No Bids Are Received

rmdanxyz

Title

Loss of Tokens Backed from Auction When No Bids Are Received

Vulnerability Details

In the FjordAuction contract, the owner is set to msg.sender during initialization. However, msg.sender in this context is the FjordAuctionFactory contract , which does not have a mechanism to handle the return of tokens if no bids are placed.

function createAuction(
address auctionToken,
uint256 biddingTime,
uint256 totalTokens,
bytes32 salt
) external onlyOwner {
address auctionAddress = address(
new FjordAuction{ salt: salt }(fjordPoints, auctionToken, biddingTime, totalTokens)
);
​
// Transfer the auction tokens from the msg.sender to the new auction contract
IERC20(auctionToken).transferFrom(msg.sender, auctionAddress, totalTokens);
​
emit AuctionCreated(auctionAddress);
}
@> owner = msg.sender;

here we deploy and create an auction through create2 opcode, and setting msg.sender which equal to FjordAuctionFactory to the owner of Auction contract.

if (totalBids == 0) {
@> auctionToken.transfer(owner, totalTokens);
return;
}

Here, totalTokens are transferred back to the owner if totalBids is zero. Since owner is the FjordAuctionFactory, and the FjordAuctionFactory does not have a function to manage the returned tokens properly, this results in a loss of tokens.

Impact

Tokens backed by the auction are lost if no bids are received. The tokens are transferred to FjordAuctionFactory that does not have a proper function to handle or manage them, leading to potential loss of funds.

Tools Used

Manual code review

Recommendations

To mitigate this issue, the FjordAuctionFactory contract should include a function to handle tokens returned from the auction. Here is a recommended function to be added to the FjordAuctionFactory.sol:

function transfer(address _from, address _to, uint256 _tokenAmount) external onlyOwner {
require(_to != address(0), "Invalid address");
require(_tokenAmount > 0, "Invalid token amount");
auctionToken.transferfrom(_from, _to, _tokenAmount);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

If no bids are placed during the auction, the `auctionToken` will be permanently locked within the `AuctionFactory`

An auction with 0 bids will get the `totalTokens` stuck inside the contract. Impact: High - Tokens are forever lost Likelihood - Low - Super small chances of happening, but not impossible

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.