Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing Input Parameter Validation in Auction Constructor

zuhaib44

Summary

The Auction contract's constructor lacks proper input parameter validation, allowing the contract to be deployed with potentially invalid or malicious parameters that could break core functionality or create unexpected behavior.

Vulnerability Details

The constructor accepts several critical parameters that determine the auction's behavior:

  • _startTime and _endTime: Temporal boundaries of the auction

  • _startingPrice and _reservePrice: Price parameters

  • _totalAllocated: Total ZENO tokens available

  • Various address parameters (_zenoAddress, _usdcAddress, _businessAddress, _initialOwner)

None of these parameters are validated, which could lead to:

  1. End time being set before start time

  2. Zero or negative prices

  3. Zero total allocation

  4. Invalid or zero addresses being set

  5. Prices that could cause mathematical overflow/underflow in getPrice()

Impact

The lack of input validation could result in:

  • Permanently broken auction functionality

  • Immediate end of auction upon deployment

  • Invalid price calculations

  • Unusable contract state

  • Loss of funds due to incorrect price calculations

  • Potential DOS conditions

Tools Used

Manual Analysis

Recommendations

Add comprehensive input validation in the constructor:

/////
​
// Time validation
require(_startTime > block.timestamp, "Start time must be in the future");
require(_endTime > _startTime, "End time must be after start time");
// Price validation
require(_startingPrice > 0, "Starting price must be positive");
require(_reservePrice > 0, "Reserve price must be positive");
require(_startingPrice >= _reservePrice, "Starting price must be >= reserve price");
// Allocation validation
require(_totalAllocated > 0, "Total allocated must be positive");
​
// ... rest of the constructor code ...
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.