Fjord Token Staking
Fjord
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Some auctionTokens will be permanently stuck in FjordAuction.sol due to a lack of a "dust collector" function.

sungyuk1

Summary

Due to precision loss from solidity division, the amount that is sent to users via the claimTokens() function will always be rounded down. Although the amount that is lost can be small, the claimTokens() functions could easily be called thousands to tens of thousands of times, and at scale the amount of auctionTokens that end up stuck in the FjordAuction contract could be significant. In such a scenario, it is beneficial to have a methodology to withdrawal the cumulative sum of the dust that ends up in the contract due to precision loss.

Vulnerability Details

The claimable variable in the claimTokens() function will always round down for every call made by a user. Therefore, extra auctionTokens will start to build up in the FjordAuction contract with calls to claimTokens(). These leftover auctionTokens will be permanently stuck in the contract due to a lack of a dust collector function to remove the leftover auctionTokens.

function claimTokens() external {
if (!ended) {
revert AuctionNotYetEnded();
}
​
uint256 userBids = bids[msg.sender];
if (userBids == 0) {
revert NoTokensToClaim();
}
​
uint256 claimable = userBids.mul(multiplier).div(PRECISION_18);
bids[msg.sender] = 0;
​
auctionToken.transfer(msg.sender, claimable);
emit TokensClaimed(msg.sender, claimable);
}

Impact

Valuable tokens could be permanently stuck in the FjordAuction contract with no way to retrieve them.

Tools Used

Manual Review

Recommendations

Add a dust collector function

Updates

Lead Judging Commences

inallhonesty Lead Judge
10 months ago
inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

FjordAuction doesn't handle the dust remained after everyone claimed

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.