Fjord Token Staking
Fjord
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Users can still bid or unbid if `block.timestamp` reaches `auctionEndTime`

gajiknownnothing

Summary

In the FjordAuction contract, users still can bid or unbid when block.timestamp is equal to auctionEndTime.

Vulnerability Details

Users cannot bid() or unbid() an auction if block.timestamp > auctionEndTime.

The auction cannot be ended if block.timestamp < auctionEndTime.

Above conditions do not cover the case when block.timestamp == auctionEndTime.

Impact

Users can still bid or unbid if block.timestamp reaches auctionEndTime.

Tools Used

vscode

Recommendations

@@ -141,7 +141,7 @@ contract FjordAuction {
* @param amount The amount of FjordPoints to bid.
*/
function bid(uint256 amount) external {
- if (block.timestamp > auctionEndTime) {
+ if (block.timestamp >= auctionEndTime) {
revert AuctionAlreadyEnded();
}
@@ -157,7 +157,7 @@ contract FjordAuction {
* @param amount The amount of FjordPoints to withdraw.
*/
function unbid(uint256 amount) external {
- if (block.timestamp > auctionEndTime) {
+ if (block.timestamp >= auctionEndTime) {
revert AuctionAlreadyEnded();
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 9 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Users can bid in the same block when the actionEnd could be called (`block.timestamp==actionEndTime`), depending on the order of txs in block they could lose funds

The protocol doesn't properly treat the `block.timestamp == auctionEndTime` case. Impact: High - There are at least two possible impacts here: 1. By chance, user bids could land in a block after the `auctionEnd()` is called, not including them in the multiplier calculation, leading to a situation where there are insufficient funds to pay everyone's claim; 2. By malice, where someone can use a script to call `auctionEnd()` + `bid(totalBids)` + `claimTokens()`, effectively depriving all good faith bidders from tokens. Likelihood: Low – The chances of getting a `block.timestamp == auctionEndTime` are pretty slim, but it’s definitely possible.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.