Unintended Token Lockup: User can't withdraw auctionToken from FjordAuctionFactory
Summary
Owner can create a new auction contract by using createAuction function in the FjordAuctionFactory.
In this case, the owner of the FjordAuction is the address of the FjordAuctionFactory.
When the auction ends and totalBids is 0, the auctionToken will be transferred to the FjordAuctionFactory.
However, the FjordAuctionFactory contract does not have a function to withdraw the auctionToken from the contract.
Vulnerability Details
Impact
The owner of the FjordAuctionFactory contract cannot withdraw the auctionToken from the contract.
Tools Used
Manual review
Recommendations
It's recommended that a function be added to withdraw the auction token from the FjordAuctionFactory contract.
Lead Judging Commences
If no bids are placed during the auction, the `auctionToken` will be permanently locked within the `AuctionFactory`
An auction with 0 bids will get the `totalTokens` stuck inside the contract. Impact: High - Tokens are forever lost Likelihood - Low - Super small chances of happening, but not impossible
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.