Summary

The vulnerability identified relates to the use of IERC20.transferFrom without proper error handling in the FjordAuctionFactory contract. Certain ERC20 tokens do not revert on failure but instead return false. This issue may lead to undetected transfer failures, which could have serious consequences for the integrity of the contract.

Vulnerability Details

• Found in src/FjordAuctionFactory.sol at Line 63

@>: Some tokens do not revert on failure, but instead return false (e.g. ZRX, EURS). While this is technically compliant with the ERC20 standard, it goes against common Solidity coding practices and may be overlooked by developers who forget to wrap their calls to transfer in a require.

Impact

This vulnerability could lead to silent failures in the createAuction function. If the auctionToken does not revert but instead returns false on failure, the contract may assume that the transfer was successful when it was not. This could result in auctions being created without the required tokens, leading to potential loss of funds for bidder and degraded protocol reliability.

Tools Used

Manual Review

Recommendations

It is recommended to use OpenZeppelin's SafeERC20 library or Solmate's SafeTransferLib to ensure that ERC20 operations are handled safely and that any errors are detected and handled correctly.