Missing check causes bid(), unbid(), auctionEnd() & claimTokens() to be executed in a single block
Summary
The missing check allows user the call all auction methods when block.timestamp == auctionEndTime in FjordAuction.sol. Which can lead to variety of impacts as mentioned below.
Vulnerability Details
At time block.timestamp == auctionEndTime a malicious user can perform several type of attack that impact other users in the auction as follows:
A user can
bid()high amountauctionEnd()and thenunbid()in a single transaction. Which causesmultiplierto be calculated with inflated value leading to genuine users getting lesser amount when theyclaimTokens(). Also, the impacted auction token will be stuck in the contract.A malicious user can
auctionEnd()and thenbid()andclaimTokens()in a single call. This will lead to it getting the auction token at a discount price because it bid token after themultiplierwas calculated. Also, the users whoclaimTokens()at the end will not be able to claim because the malicious user claimed more portion and there won't be enough auction tokens for them to claim.A malicious user will frontrun all txns and
auctionEnd()so other users can'tbid()and dilute the auction more.
Impact
All the above attacks will lead to either the malicious user getting more auction tokens or genuine users not being able to fully claim leading to reverts.
Tools Used
Manual Review
Recommendations
Either let the auction proceed till auctionEndTime or end auction at auctionEndTime. Don't let both happen on the same block.
Lead Judging Commences
Users can bid in the same block when the actionEnd could be called (`block.timestamp==actionEndTime`), depending on the order of txs in block they could lose funds
The protocol doesn't properly treat the `block.timestamp == auctionEndTime` case. Impact: High - There are at least two possible impacts here: 1. By chance, user bids could land in a block after the `auctionEnd()` is called, not including them in the multiplier calculation, leading to a situation where there are insufficient funds to pay everyone's claim; 2. By malice, where someone can use a script to call `auctionEnd()` + `bid(totalBids)` + `claimTokens()`, effectively depriving all good faith bidders from tokens. Likelihood: Low – The chances of getting a `block.timestamp == auctionEndTime` are pretty slim, but it’s definitely possible.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.