Fjord Token Staking
Fjord
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Whole `auctionToken` will be lost if `create2` fails with `address(0)`

bladesec

Summary

It is possible that create2 fails with address(0) which then locks all auctionToken to zero-address.

Vulnerability Details

The FjordAuctionFactory contract uses create2 to deploy new FjordAuction contracts:

address auctionAddress = address(
new FjordAuction{ salt: salt }(fjordPoints, auctionToken, biddingTime, totalTokens)
);

However, there are couple scenarios it can fail with address(0).

  • It's a well-known issue that create2 can fail if the deployment operation fails and return address(0)

  • Also, it's vulnerable to front-running attacks where a malicious actor could precompute the auction address and deploy their own contract at that address before the AuctionFactory does.

Since FjordAuctionFactory contract does not check if create2 returns address(0), and sends the auctionToken in the same transaction as the create2 operation, the auctionToken will be locked in the zero-address.

// Transfer the auction tokens from the msg.sender to the new auction contract
IERC20(auctionToken).transferFrom(msg.sender, auctionAddress, totalTokens);

Impact

Due to improper validation, the auctionToken will be lost.

Tools Used

Manual Review

Recommendations

  1. Consider using a more secure method for generating the salt such as using nonce.

  2. Adopt a proper validation on returned auction address.

function createAuction(
address auctionToken,
uint256 biddingTime,
uint256 totalTokens,
bytes32 salt
) external onlyOwner {
address auctionAddress = address(
new FjordAuction{ salt: salt }(fjordPoints, auctionToken, biddingTime, totalTokens)
);
​
+ require(auctionAddress != address(0), "Zero address");
​
// Transfer the auction tokens from the msg.sender to the new auction contract
IERC20(auctionToken).transferFrom(msg.sender, auctionAddress, totalTokens);
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.