Fjord Token Staking

Summary

The FjordAuctionFactory and FjordAuction contracts interact with ERC20 tokens without using OpenZeppelin's SafeERC20 library. This could possibly lead to failed transfers. For better safety use the SafeERC20 library.

Vulnerability Details

In both FjordAuctionFactory and FjordAuction contracts, ERC20 token interactions are performed using direct calls to the token contracts, rather than using the SafeERC20 library. For example:

In FjordAuctionFactory:

https://github.com/Cyfrin/2024-08-fjord/blob/0312fa9dca29fa7ed9fc432fdcd05545b736575d/src/FjordAuctionFactory.sol#L63

In FjordAuction:

https://github.com/Cyfrin/2024-08-fjord/blob/0312fa9dca29fa7ed9fc432fdcd05545b736575d/src/FjordAuction.sol#L151

https://github.com/Cyfrin/2024-08-fjord/blob/0312fa9dca29fa7ed9fc432fdcd05545b736575d/src/FjordAuction.sol#L174

Impact

This could lead to failed or inconsistent transfers.

Tools Used

Manual Review

Recommendations

Implement the following changes:

1. Import and use OpenZeppelin's SafeERC20 library for both contracts:
   ```solidity

   import "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
   ```

2. Apply the library to all ERC20 interactions. For example, in FjordAuctionFactory:
   ```solidity
   using SafeERC20 for IERC20;

   // In createAuction function:
   IERC20(auctionToken).safeTransferFrom(msg.sender, auctionAddress, totalTokens);

   ```

3. In FjordAuction, update all token interactions:
   ```solidity
   using SafeERC20 for IERC20;
   using SafeERC20 for ERC20Burnable;

   // In bid function:
   fjordPoints.safeTransferFrom(msg.sender, address(this), amount);

   // In claimTokens function:
   auctionToken.safeTransfer(msg.sender, claimable);

   ```