Fjord Token Staking
Fjord
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Users can still bid after the auction ends, thereby increasing their own profits and making it impossible for some users to claim rewards.

zraxx

Summary

Users can still bid after the auction ends, thereby increasing their own profits and making it impossible for some users to claim rewards.

Vulnerability Details

Function auctionEnd is used to end the auction and calculates claimable tokens for each bidder. However, the check for block.timestamp is:

if (block.timestamp < auctionEndTime) {
revert AuctionNotYetEnded();
}
​

So when the block.timestamp = auctionEndTime, the auction can be ended. At the same time, the function bid and unbid check the block.timestamp:

if (block.timestamp > auctionEndTime) {
revert AuctionAlreadyEnded();
}
​

So when the block.timestamp = auctionEndTime, the users can still bid and unbid.

Therefore, when the block.timestamp = auctionEndTime, attacker can end the auction and bid it at the same time, which can increase his/her own profit and make it impossible for other users to claim rewards.

For exampe, when auction is ended, the totalBids = 1000 (attacker’s bid = 200), totalTokens = 10000, so multiplier = 10e18. At the same time, attacker bids for 800. So, his/her total bid will be 1000, which means attack can claim all tokens. Finally, other users can’t claim their tokens any more.

Impact

Attacker can bid after the auction is ended, in order to increase the profit and make other users can’t claim their tokens.

Tools Used

Vscode

Recommendations

The check for block.timestamp should be more strict.

function auctionEnd() external {
if (block.timestamp <= auctionEndTime) {
revert AuctionNotYetEnded();
}
if (ended) {
revert AuctionEndAlreadyCalled();
}
​
Updates

Lead Judging Commences

inallhonesty Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Users can bid in the same block when the actionEnd could be called (`block.timestamp==actionEndTime`), depending on the order of txs in block they could lose funds

The protocol doesn't properly treat the `block.timestamp == auctionEndTime` case. Impact: High - There are at least two possible impacts here: 1. By chance, user bids could land in a block after the `auctionEnd()` is called, not including them in the multiplier calculation, leading to a situation where there are insufficient funds to pay everyone's claim; 2. By malice, where someone can use a script to call `auctionEnd()` + `bid(totalBids)` + `claimTokens()`, effectively depriving all good faith bidders from tokens. Likelihood: Low – The chances of getting a `block.timestamp == auctionEndTime` are pretty slim, but it’s definitely possible.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.