Fjord Token Staking

Summary

The FjordAuction contract is vulnerable to a race condition that can be exploited by a malicious user. This vulnerability arises when a user places a bid (bid()) in the last block of the auction while another user calls auctionEnd() in the same block.

The bid might not be fully processed before the multiplier is calculated in auctionEnd(), leading to an incorrect and potentially manipulable final distribution of the auctioned tokens.

Vulnerability Details

The race condition occurs between the bid() and auctionEnd() functions. An honest user decides at the last moment to call bid(). But in the meantime, someone else calls auctionEnd() at the last moment and the bid is not counted. This is possible because both functions can be called when block.timestamp = auctionEndTime.

If bid() is executed after auctionEnd() has calculated the multiplier but within the same block, the new bid will not be reflected in the multiplier calculation. This situation could be exploited by a malicious user who bids in the last block to manipulate the auction outcome.

Impact

The multiplier willt be calculated based on a lower totalBids than actually exists, leading to an incorrect distribution of the auctionToken. Users who placed valid bids could receive fewer tokens than they are entitled to, while the final user might benefit unfairly.

Tools Used

Visual Studio Code

Recommendations

To prevent this exploitation, implement a check that disables the bid() function in the final block when the auction is about to end. This ensures that all bids are fully processed before the auction is finalized.