If an auction ends with 0 totalBids, the auctionTokens are lost in factory contract
Summary
Using the function AuctionFactory::createAuction, the AuctionFactory contract becomes the owner of a new FjordAuction contract. If the FjordAuction contract ends without any bidder, the tokens used for the auction are send back to the Factory contract, but the contract can't transfer them, locking them forever.
Vulnerability Details
This occurs when an auction ends with 0 bids. FjordAuction::auctionEnd sends back the tokens to the owner (the factory contract), and these tokens can't be withdrawn then.
Impact
Tokens are forever lost.
Recommendations
Add a withdraw function in the factory, accessible only to the owner, to withdraw ERC20 tokens.
Lead Judging Commences
If no bids are placed during the auction, the `auctionToken` will be permanently locked within the `AuctionFactory`
An auction with 0 bids will get the `totalTokens` stuck inside the contract. Impact: High - Tokens are forever lost Likelihood - Low - Super small chances of happening, but not impossible
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.