Fjord Token Staking
Fjord
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

```FjordAuction::bid``` function in ``` src/FjordAuction.sol ``` lacks a zero amount check causing it emit misleading ```BidAdded``` event.

nathanielYeboa

Vulnerability Details

Anyone can pass zero amount to the FjordAuction::bid function to emit a BidAdded event.. An attacker who might flood the logs can do this multiple times.

Impact

While this will not impact the contract's funds, monitoring tools may be overflooded with false events emitted by the FjordAuction contract.

Tools Used

Manual Review

Proof of Concept:

  1. A single address can bid with zero amount once or multiple times

  2. A list of addresses can do the same as a single

Here is an illustration,
Add this test function to the test/unit/auction.t.sol:TestAuction test contract

function testAuctionDoesNotRevrtWithZeroAmountBid() public {
// a single address
address bidder1 = makeAddr("bidder1");
uint256 gasStartA = gasleft();
vm.prank(bidder1);
auction.bid(0);
uint256 gasCostA = gasStartA - gasleft();
console.log("gasCostA", gasCostA);
​
//multiple addresses ,say 200
uint160 length = 200;
for (uint160 i = 1; i < length; i++) {
address dos = address(i);
uint256 gasStartDos = gasleft();
vm.prank(dos);
auction.bid(0);
auction.bid(0);
uint256 gasCostPerDos = gasStartDos - gasleft();
console.log("gasCostPerDos", gasCostPerDos);
}
​
// ending the bid
​
skip(biddingTime);
​
uint256 balBefore = auctionToken.balanceOf(auction.owner());
auction.auctionEnd();
uint256 balAfter = auctionToken.balanceOf(auction.owner());
// bid ends
assertEq(auction.ended(), true);
assertEq(balAfter - balBefore, totalTokens);
}

run forge test --mt testAuctionDoesNotRevrtWithZeroAmountBid -vvvvv in the terminal to see the events of the zero-amount bid.

Recommended Mitigation: Add zero amount checks to the FjordAuction::bid function.

+ error BidMustNotBeZero(); // custom error thrown on a zero amount bid
​
function bid(uint256 amount) external {
+ if (amount == 0) {
+ revert BidMustNotBeZero();
+ }
...
}
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.