Fjord Token Staking
Fjord
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

The user loses all points when block.timestamp equals auctionEndTime

merlin

Summary

If a user places a bid in the auction at block.timestamp == auctionEndTime, someone else can frontrun the bid() transaction by calling auctionEnd() first, resulting in the user losing their points.

Vulnerability Details

Consider the following scenario:

  1. A user calls the FjordAuction.bid function (placing a bid in the auction when block.timestamp == auctionEndTime).

  2. A frontrunner detects the transaction in the mempool and sends an auctionEnd() transaction faster.

  3. As a result, the user's transaction is successfully processed, but the bid is placed in an already ended auction.

This issue occurs due to an incorrect check of whether the auction has ended.

///bid
if (block.timestamp > auctionEndTime) {
revert AuctionAlreadyEnded();
}
​
///auctionEnd
if (block.timestamp < auctionEndTime) {
revert AuctionNotYetEnded();
}

Impact

The user ends up losing all their points as a result of the issue

Tools Used

Manual review

Recommendations

The AuctionNotYetEnded check needs to be updated as follows

function auctionEnd() external {
- if (block.timestamp < auctionEndTime) {
+ if (block.timestamp <= auctionEndTime) {
revert AuctionNotYetEnded();
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Users can bid in the same block when the actionEnd could be called (`block.timestamp==actionEndTime`), depending on the order of txs in block they could lose funds

The protocol doesn't properly treat the `block.timestamp == auctionEndTime` case. Impact: High - There are at least two possible impacts here: 1. By chance, user bids could land in a block after the `auctionEnd()` is called, not including them in the multiplier calculation, leading to a situation where there are insufficient funds to pay everyone's claim; 2. By malice, where someone can use a script to call `auctionEnd()` + `bid(totalBids)` + `claimTokens()`, effectively depriving all good faith bidders from tokens. Likelihood: Low – The chances of getting a `block.timestamp == auctionEndTime` are pretty slim, but it’s definitely possible.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.