Fjord Token Staking
Fjord
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Auction tokens can be stuck in the FjordAuctionFactory contract

gkrastenov

Summary

Auction tokens can be stuck in the FjordAuctionFactory contract

Vulnerability Details

When a new auction is created and started, users can bid Fjord points to earn rewards from the auctioned tokens. If totalBids == 0 (i.e., no bids are made), the total auction tokens are returned to the owner, which is the FjordAuctionFactory contract.

if (totalBids == 0) {
​
auctionToken.transfer(owner, totalTokens);
return;
}

These tokens cannot be withdrawn from the factory contract and cannot be used for newly created auctions in the future.

The variable totalTokens is an input parameter set by msg.sender when the auction is created and tokens are transferred to the newly created auction. The msg.sender cannot reuse the tokens that are stuck in the contract.

function createAuction(
address auctionToken,
uint256 biddingTime,
uint256 totalTokens,
bytes32 salt
) external onlyOwner {
address auctionAddress = address(
new FjordAuction{ salt: salt }(fjordPoints, auctionToken, biddingTime, totalTokens)
);
​
// Transfer the auction tokens from the msg.sender to the new auction contract
IERC20(auctionToken).transferFrom(msg.sender, auctionAddress, totalTokens);
​
emit AuctionCreated(auctionAddress);
}

Impact

Auction tokens can be stuck in the factory contract forever.

Tools Used

Manual

Recommendations

Return the auction tokens to the msg.sender of the createAuction() function when the auction is created.

Updates

Lead Judging Commences

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

If no bids are placed during the auction, the `auctionToken` will be permanently locked within the `AuctionFactory`

An auction with 0 bids will get the `totalTokens` stuck inside the contract. Impact: High - Tokens are forever lost Likelihood - Low - Super small chances of happening, but not impossible

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.