Fjord Token Staking

Relevant Github Links

https://github.com/Cyfrin/2024-08-fjord/blob/0312fa9dca29fa7ed9fc432fdcd05545b736575d/src/FjordAuctionFactory.sol#L59
https://github.com/Cyfrin/2024-08-fjord/blob/0312fa9dca29fa7ed9fc432fdcd05545b736575d/script/forge/DeployAuction.s.sol#L18

Summary

By precomputing the address of the auction contract, an attacker can disrupt the auction process, causing financial losses and operational issues. Mitigating these vulnerabilities involves using unpredictable salts, performing pre-deployment checks, and implementing robust access control mechanisms.

Vulnerability Details

The salt is predictable because it relies on the block.timestamp and msg.sender, both of which are publicly available and easily accessible on the blockchain. An attacker could front-run or duplicate the auction creation by predicting the salt value, potentially causing unintended behavior or duplicate auctions.

The AuctionFactory contract is designed to create new instances of an auction contract (FjordAuction) using the create2 opcode. The `FjordAuctionScript is responsible for calling this factory to create auctions.

Impact

Impact on create2 Deterministic Address:

• The createAuction function uses create2 to generate a deterministic address for the new auction contract, based on the salt provided. If the salt is predictable, an attacker could precompute or predict the auction contract's address and potentially take malicious actions, such as deploying a contract with the same address on another chain or attempting to interfere with the auction.

Tools Used

Manual Review

Recommendations

The salt value should be carefully generated, preferably using a more complex and unpredictable value. The current script's approach of using keccak256(abi.encodePacked(block.timestamp, msg.sender)) is predictable and should be replaced with a more secure random value, or it should allow users to specify their own unique and unpredictable salt.

Reference: https://solodit.xyz/issues/m-11-factorycreate-predictability-of-pool-address-creates-multiple-issues-code4rena-caviar-caviar-private-pools-git