Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing Auction State Finalization

Deleted user

Summary

After reviewing Auction.sol, I confirm this is a valid finding but with low severity since it's primarily an event emission issue without direct economic impact.

Vulnerable Code

function checkAuctionEnded() external {
require(block.timestamp >= state.endTime, "Auction not ended");
emit AuctionEnded(getPrice()); // Only emits event, no state changes
}

Technical Impact Analysis

  1. No State Change

// Current implementation
function checkAuctionEnded() external {
require(block.timestamp >= state.endTime, "Auction not ended");
emit AuctionEnded(getPrice());
// Missing:
// - No final state recording
// - No remaining token handling
// - No isEnded flag
}

  1. Event Dependency

// External systems must actively monitor
function getAuctionStatus() external {
if(block.timestamp >= auction.state.endTime) {
// Must call checkAuctionEnded() to get event
// No on-chain state to query
}
}

Recommended Mitigation

contract Auction is IAuction, Ownable {
// Add state variable
bool public isEnded;
function finalizeAuction() external {
require(block.timestamp >= state.endTime, "Auction not ended");
require(!isEnded, "Auction already finalized");
// Update state
isEnded = true;
uint256 finalPrice = getPrice();
// Handle remaining tokens if any
if (state.totalRemaining > 0) {
// Option 1: Return to owner
zeno.mint(owner(), state.totalRemaining);
// Option 2: Burn
state.totalAllocated -= state.totalRemaining;
state.totalRemaining = 0;
}
emit AuctionEnded(
finalPrice,
state.totalAllocated - state.totalRemaining,
state.totalRemaining
);
}
// Update modifier
modifier whenActive() {
require(block.timestamp > state.startTime, "Auction not started");
require(block.timestamp < state.endTime, "Auction ended");
require(!isEnded, "Auction finalized");
_;
}
}

Additional Recommendations

  1. Add finalization events:

event AuctionFinalized(
uint256 finalPrice,
uint256 totalSold,
uint256 totalUnsold,
uint256 totalRaised
);

  1. Add getter function:

function getAuctionStatus() external view returns (
bool initialized,
bool started,
bool ended,
bool finalized
) {
return (
true,
block.timestamp > state.startTime,
block.timestamp >= state.endTime,
isEnded
);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!