Fjord Token Staking

Summary

The creation process of FjordAuction lacks proper validation for the biddingTime and totalTokens parameters.

Vulnerability Details

If biddingTime is set to 0,

• it could end with no bidder that leads to potential lock of whole auctionToken, because it's sent to the auctionFactory from which we can't withdraw the token

• it lets malicious attackers grab the whole actionToken instantly by bidding a minimum amount of fjordPoints, ending the action and claiming all the actionToken.

If totalTokens is set to 0, auction would offer nothing for bidders.

Impact

Without input validation, auctions could be created with invalid parameters, leading to failed or malfunctioning auctions. This could result in the loss of auction functionality, wasted gas fees, and potential loss of tokens or funds.

Tools Used

Manual Review

Recommendations

Implement validation checks to ensure:

• biddingTime > 0

• totalTokens > 0