Summary

ERC20 implementations are not always consistent. Some implementations of transfer and transferFrom
could return ‘false’ on failure instead of reverting. It is safer to wrap such calls into require()
statements or use safe wrapper functions implementing return value/data checks to handle these failures.

If createAuction() is called and the ERC20 transfer
fails but transferFrom() returns false instead of reverting, it will not transfer any tokens to FjordAuction but will indeed create an auction with totalTokens without transfering them.

Vulnerability Details

Impact

Users will be able to bid and unbid normally. But claimTokens() and auctionEnd() will fail causing dns.
The owner of the auctionToken could transfer some tokens to FjordAuction after the
incident is detected. But, this can cause some trust issues and in my opinion transfer of auctionTokens to a FjordAuction
should be enforced.

Tools Used

Manual analysis.

Recommendations

Consider using safeTransferFrom instead of transferFrom which will handle
returned values.