Fjord Token Staking
Fjord
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Auction tokens can become permanently locked in the FjordAuctionFactory contract if no bids are placed

ast3ros

Summary

If an auction concludes without any bids, the auction tokens are transferred to the owner address, which is set to the FjordAuctionFactory contract. This can result in tokens becoming permanently locked in the factory contract, as there is no mechanism to retrieve them.

Vulnerability Details

In FjordAuction.sol, the contract's owner is set to the msg.sender in the constructor, which is the FjordAuctionFactory contract:

constructor(
address _fjordPoints,
address _auctionToken,
uint256 _biddingTime,
uint256 _totalTokens
) {
...
owner = msg.sender; // @audit owner is set to FjordAuctionFactory
...
}

https://github.com/Cyfrin/2024-08-fjord/blob/14cab810598ddda6008d9523d0ed4a428b1b1153/src/FjordAuction.sol#L120-L137

If the auction ends with no bids, all auction tokens are transferred to the owner address:

function auctionEnd() external {
...
if (totalBids == 0) {
auctionToken.transfer(owner, totalTokens); // @audit transfers to FjordAuctionFactory
return;
}
...
}

https://github.com/Cyfrin/2024-08-fjord/blob/14cab810598ddda6008d9523d0ed4a428b1b1153/src/FjordAuction.sol#L181-L202

The FjordAuctionFactory contract lacks functionality to withdraw or redistribute these tokens, effectively locking them in the contract permanently.

Impact

This vulnerability can lead to permanent loss of tokens for project creators if their auction receives no bids.

Tools Used

Manual

Recommendations

  • Add a beneficiary parameter to the createAuction function in FjordAuctionFactory.

  • Pass this beneficiary address to the FjordAuction constructor.

  • Update the FjordAuction contract to use this beneficiary address instead of owner when transferring tokens in case of no bids.

Updates

Lead Judging Commences

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

If no bids are placed during the auction, the `auctionToken` will be permanently locked within the `AuctionFactory`

An auction with 0 bids will get the `totalTokens` stuck inside the contract. Impact: High - Tokens are forever lost Likelihood - Low - Super small chances of happening, but not impossible

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.