Core Contracts

Summary

The Auction contract does not enforce a minimum duration for the auction. This omission allows the auction to be configured with an extremely short time window. In such a scenario, a last-moment bidder could win all the ZENO tokens at a significantly lower price, as users may not have sufficient time to respond before the auction ends.

Vulnerability Details

• Issue:
  The contract's constructor accepts _startTime and _endTime without verifying that the duration (i.e., _endTime - _startTime) meets a minimum threshold. Consequently, the auction could be set to a very brief period, potentially leading to unfair bidding opportunities.

• Affected Code:

  constructor(

  address _zenoAddress,

  address _usdcAddress,

  address _businessAddress,

  uint256 _startTime,

  uint256 _endTime,

  uint256 _startingPrice,

  uint256 _reservePrice,

  uint256 _totalAllocated,

  address _initialOwner

  ) Ownable(_initialOwner) {

  zeno = ZENO(_zenoAddress);

  usdc = IUSDC(_usdcAddress);

  businessAddress = _businessAddress;

  state = AuctionState({

  startTime: _startTime,

  endTime: _endTime,

  startingPrice: _startingPrice,

  reservePrice: _reservePrice,

  totalAllocated: _totalAllocated,

  totalRemaining: _totalAllocated,

  lastBidTime: 0,

  lastBidder: address(0)

  });

  }

  ​

  There is no check ensuring _endTime - _startTime is greater than a predefined minimum duration.

Impact

• Unfair Bidding Opportunities:
  A very short auction duration could enable a last-second bidder to acquire all ZENO tokens at a lower price, leaving little to no chance for competitive bids.

Tools Used

• Manual Code Review

Recommendations

1. Implement a Minimum Duration Check:
   In the constructor (or via an initialization function), ensure that the auction duration is not less than a reasonable minimum threshold (e.g., 10 minutes or more). For example:

   require(_endTime > _startTime, "End time must be after start time");

   require(_endTime - _startTime >= MIN_AUCTION_DURATION, "Auction duration too short");

   ​

   where MIN_AUCTION_DURATION could be defined as a constant.