Fjord Token Staking
Fjord
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Invalid `owner` in `FjordAuction` when Creating through `AuctionFactory` which would cause `auctionToken` blocked

vineyard

Summary

The ownerin FjordAuctionis factory address when creating it through the AuctionFactoryinstead of the msg.senderwhich would cause the token to be blocked in the AuctionFactory.

Vulnerability Details

When creating the FjordAuction through the AuctionFactory, the owner of the FjordAuction contract is assigned to msg.sender, which will be the AuctionFactory contract address.

When auctionEndinvoked, if totalBidsis 0, all auctionToken will be sent back to the owner,

if (totalBids == 0) {
auctionToken.transfer(owner, totalTokens);
return;
}

In this scenario, the owner is the AuctionFactory contract address. Since the AuctionFactory contract does not have a function to withdraw tokens, the tokens will be locked in the AuctionFactory contract, making them inaccessible.

We can check the auction balance with following test(tiny update in AuctionFactory to return auction address):

function createAuction(
address auctionToken,
uint256 biddingTime,
uint256 totalTokens,
bytes32 salt
) external onlyOwner returns(address){
...
return auctionAddress;
}
function testLockedTokenWhenAuctionEnd() public {
AuctionFactory af = new AuctionFactory(address(fjordPoints));
​
deal(address(auctionToken), address(this), totalTokens);
auctionToken.approve(address(af), totalTokens);
​
address au = af.createAuction(address(auctionToken), biddingTime, totalTokens, "0x0");
skip(biddingTime + 1);
​
FjordAuction(au).auctionEnd();
assertEq(auctionToken.balanceOf(address(af)), totalTokens);
}

Impact

The refund token while totalBids == 0will be locked in the AuctionFactory contract.

Tools Used

Manual

Recommendations

There could be several possible solutions:
- use tx.origininstead for owner
- pass owner as a parameter while creating auction contract
- adding withdraw function with onlyOwner modifier in the auction factory contract

Updates

Lead Judging Commences

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

If no bids are placed during the auction, the `auctionToken` will be permanently locked within the `AuctionFactory`

An auction with 0 bids will get the `totalTokens` stuck inside the contract. Impact: High - Tokens are forever lost Likelihood - Low - Super small chances of happening, but not impossible

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.