Fjord Token Staking

Vulnerability Details:

The createAuction function lacks proper validation for its input parameters. This could lead to the creation of auctions with unintended or potentially harmful settings.

Impact:

Auctions could be created with extremely short bidding times, unreasonably large token amounts, or other problematic parameters, potentially leading to unfair auctions or system abuse.

Proof of Concept:

Link to code

Tools Used: Manual review

Recommendations:

1. Implement parameter validation:

   function createAuction(

   address auctionToken,

   uint256 biddingTime,

   uint256 totalTokens,

   bytes32 salt

   ) external onlyOwner {

   require(auctionToken != address(0), "Invalid auction token");

   require(biddingTime >= MIN_BIDDING_TIME && biddingTime <= MAX_BIDDING_TIME, "Invalid bidding time");

   require(totalTokens > 0 && totalTokens <= MAX_TOTAL_TOKENS, "Invalid total tokens");

   // ... rest of the function ...

   }

2. Consider implementing upper and lower bounds for biddingTime and totalTokens.