Fjord Token Staking

Summary

Permanent loss of funds for protocol when there is no active bid at the end of an auction

Vulnerability Details

The issue arises from the creation of a new auction contract in FjordAuctionFactory.sol https://github.com/Cyfrin/2024-08-fjord/blob/0312fa9dca29fa7ed9fc432fdcd05545b736575d/src/FjordAuctionFactory.sol#L52-L60 and the assigning of owner in the constructor of the the newly deployed FjordAuction.sol to the msg.sender of the constructor which in actuality is not the dev/owner but FjordAuctionFactory.sol https://github.com/Cyfrin/2024-08-fjord/blob/0312fa9dca29fa7ed9fc432fdcd05545b736575d/src/FjordAuction.sol#L120-L134 . So in the very probable event that there is no active bid at the end of an auction and auctionEnd() is called which can be called by anyone, all the tokens in the contract are sent to the owner which is FjordAuctionFactory.sol and not the dev https://github.com/Cyfrin/2024-08-fjord/blob/0312fa9dca29fa7ed9fc432fdcd05545b736575d/src/FjordAuction.sol#L192-L195

and there's no way to withdraw tokens from FjordAuctionFactory.sol so the tokens are permanently stuck there.

Keeping this as high because it causes permanent loss of funds under normal protocol operation with the only constraint being having an active bid which I believe is also expected to happen.

Impact

Permanent loss of funds for protocol

Tools Used

Manual Review

Recommendations

Add a new argument in the constructor that carries msg.sender from FjordAuctionFactory.sol as a parameter and sets it as the owner