Fjord Token Staking

Summary

The FjordAuction::auctionEnd is currently callable by anyone. This function is responsible for ending the auction, calculating claimable tokens for each bidder, and burning the FjordPoints held by the contract. While the function includes a check to ensure that the current time is past the auctionEndTime, it does not restrict who can call it.

Link: https://github.com/Cyfrin/2024-08-fjord/blob/0312fa9dca29fa7ed9fc432fdcd05545b736575d/src/FjordAuction.sol#L181C5-L202C6

Vulnerability Details

The lack of access control on the auctionEnd function allows any external account to end the auction. This leads to unintended consequences such as premature token transfers.

Impact

Let's consider a real-world scenario where the control over the exact timing of the auction's end could be strategically important for the owner or the entity managing the auction.

Scenario:

The auction is for a highly anticipated new token in the Fjord ecosystem.
The auction end time is set to a specific date/time, but the market conditions around that time are volatile.
The owner of the auction contract is closely monitoring the market conditions to ensure the best possible outcome for the auction.

Issues with unrestricted Access:

• Market Volatility: The market for the token being auctioned is highly volatile. The owner wants to end the auction at a moment when the market conditions are most favorable, even if it's slightly after the auctionEndTime. If anyone can end the auction, they might do so at a less favorable moment, potentially leading to lower bids and less favorable outcomes for the auction participants.

• Coordination with Other Events: The auction might be part of a larger event or series of events within the ecosystem. The owner might want to coordinate the auction's end with other events to maximize engagement and participation. If anyone can end the auction, it could disrupt this coordination and lead to suboptimal outcomes.

The owner or the entity managing the auction loses control over the exact timing of the auction's end.

There might be strategic reasons for the owner to end the auction at a specific moment after the auctionEndTime, such as waiting for favorable market conditions or coordinating with other events.

Tools Used

Manual review

Recommendations

Restrict the auctionEnd function to be callable only by the owner or an authorized entity.