Core Contracts

Summary

The Auction contract does not validate key parameters during deployment:

Zero Allocation : If totalAllocated = 0, no ZENO tokens can be sold, making the auction meaningless.
Time Reversal : If endTime <= startTime, the getPrice function will attempt to divide by zero, causing a revert whenever the price is queried.

Vulnerability Details

The constructor of the Auction contract does not enforce constraints on the input parameters (totalAllocated, startTime, and endTime).
This allows accidental deployment with invalid values, leading to broken functionality

To ensure the Auction contract works as intended, the following preconditions must hold after deployment:

Violation :
Deploying with totalAllocated = 0 or endTime <= startTime violates these preconditions, breaking core functionality.

Impact

• If totalAllocated = 0, the buy function will always fail because amount <= state.totalRemaining will never be true.

• If endTime <= startTime, the getPrice function will attempt to divide by zero, causing all price-related operations to revert.

Tools Used

Recommendations

• Check totalAllocated > 0

• Check endTime > startTime