Fjord Token Staking

Summary

Variable totalTokens on FjordAuction represents the amount of tokens available for distribution in the auction. It is set in the constructor. Admin input is trusted here but the amount of auction tokens the protocol gains could change in the meantime thus breaking the auction contract.

Vulnerability Details

If the amount of tokens to be auctioned off were to change in the meantime (from contract deployment to auction end) - the auction could not be closed because it expects to transfer the totalTokens to the contract owner.

Impact

On some conditions - auction CANNOT be ended - so funds can't be distributed.

Code snippet

https://github.com/Cyfrin/2024-08-fjord/blob/0312fa9dca29fa7ed9fc432fdcd05545b736575d/src/FjordAuction.sol#L193C1-L193C55

Tools Used

Manual review

Recommendations

Add a function to change the totalTokens variable on FjordAuction contract OR transfer the tokens to the contract in the same transaction where you set the totalTokens variable.