FjordAuctionFactory has no rescue/recover token ability
Summary
In FjordAuctionFactory, there is no option to withdraw the token that was mistakenly sent to the factory contract or was returned from the FjordAuction contract when no one bids for it.
Vulnerability Details
There are many cases which may cause the fund to be stuck, such as:
Wrong auctionToken sent to the
FjordAuctionFactorycontract
Mistakenly sent more amount of
totalTokensrequired by theFjordAuctionFactory
Or simply the returned auctionToken from
FjordAuctioncontract when the auction ends but no one bids for the token
...
Impact
Fund is permanently stuck within FjordAuctionFactorycontract.
Tools Used
Manual Analysis
Recommendations
Consider adding a function which can be used to recover the token in FjordAuctionFactorycontract.
Lead Judging Commences
If no bids are placed during the auction, the `auctionToken` will be permanently locked within the `AuctionFactory`
An auction with 0 bids will get the `totalTokens` stuck inside the contract. Impact: High - Tokens are forever lost Likelihood - Low - Super small chances of happening, but not impossible
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.