Fjord Token Staking

Summary

1. Use safeTransfer instead of transfer as some transfer might fail and contract also doesn't check for the return status after the auction reward token transfer in the claimTokens() function.

Vulnerability Details

The contract assumes that the token transfer is indeed success which silently could fail while claimming the tokens inside the function claimTokens() in auction contract.

https://github.com/Cyfrin/2024-08-fjord/blob/0312fa9dca29fa7ed9fc432fdcd05545b736575d/src/FjordAuction.sol#L207-L221

Impact

If transfer fails user couldn't claim again as the bidding mapping is re-set. Thus leading to funds lost for valid bidder.

Tools Used

Manual

Recommendations

Check if transfer fails and revert. Use safeTransfer as well as other parts of code already uses.