Core Contracts

Summary

The Auction contract does not enforce a minimum duration for the auction. As a result, the auction could be configured with an unreasonably short time frame. In such a case, a bidder could place a last-minute bid and win all the ZENO tokens at a much lower price, as other participants may not have sufficient time to react before the auction ends.

Vulnerability Details

• Issue:
  The constructor of the Auction contract accepts _startTime and _endTime as inputs without verifying that the auction duration (i.e., _endTime - _startTime) meets a minimum threshold. This oversight allows for the possibility of setting a very short auction duration, which may result in unfair bidding conditions.

• Affected Code:

  constructor(

  address _zenoAddress,

  address _usdcAddress,

  address _businessAddress,

  uint256 _startTime,

  uint256 _endTime,

  uint256 _startingPrice,

  uint256 _reservePrice,

  uint256 _totalAllocated,

  address _initialOwner

  ) Ownable(_initialOwner) {

  zeno = ZENO(_zenoAddress);

  usdc = IUSDC(_usdcAddress);

  businessAddress = _businessAddress;

  state = AuctionState({

  startTime: _startTime,

  endTime: _endTime,

  startingPrice: _startingPrice,

  reservePrice: _reservePrice,

  totalAllocated: _totalAllocated,

  totalRemaining: _totalAllocated,

  lastBidTime: 0,

  lastBidder: address(0)

  });

  }

  The contract does not include a check to ensure that the auction's duration is greater than a predefined minimum value, leaving room for the auction to be configured with a duration that is too short.

## Impact

• Unfair Bidding Opportunities:
  Without a minimum duration, the auction could end very quickly, allowing a last-second bidder to acquire all ZENO tokens at a lower price. This results in an unfair advantage for that bidder, as other participants may not have sufficient time to respond to the auction before it closes.

## Tools Used

• Manual Code Review

## Recommendations

1. Implement a Minimum Duration Validation:
   Add a check in the constructor (or through an initialization function) to ensure that the auction duration is not shorter than a predefined minimum value. For example, you could add the following validation:

   require(_endTime > _startTime, "End time must be after start time");

   require(_endTime - _startTime >= MIN_AUCTION_DURATION, "Auction duration is too short");