Skip to content

Latest commit

 

History

History
43 lines (30 loc) · 2.17 KB

M-03.md

File metadata and controls

43 lines (30 loc) · 2.17 KB
Raw

Auctioned tokens cannot be recovered for epochs with empty bids in DaiGoldAuction

Summary

TempleGold tokens cannot be recovered when there are no bids for a certain auction epoch.

Vulnerability Details

In the DaiGoldAuction contract batches of TempleGold tokens are offered to bidders who deposit DAI. Once an epoch finishes, each bidder can claim their share of TempleGold according to how much DAI they deposited.

150:     function claim(uint256 epochId) external virtual override {
151:         /// @notice cannot claim for current live epoch
152:         EpochInfo storage info = epochs[epochId];
153:         if (!info.hasEnded()) { revert CannotClaim(epochId); }
154:         /// @dev epochId could be invalid. eg epochId > _currentEpochId
155:         if (info.startTime == 0) { revert InvalidEpoch(); }
156: 
157:         uint256 bidTokenAmount = depositors[msg.sender][epochId];
158:         if (bidTokenAmount == 0) { revert CommonEventsAndErrors.ExpectedNonZero(); }
159: 
160:         delete depositors[msg.sender][epochId];
161:         uint256 claimAmount = bidTokenAmount.mulDivRound(info.totalAuctionTokenAmount, info.totalBidTokenAmount, false);
162:         templeGold.safeTransfer(msg.sender, claimAmount);
163:         emit Claim(msg.sender, epochId, bidTokenAmount, claimAmount);
164:     }

Line 161 defines the amount of TempleGold tokens that belong to each bidder for the given epochId.

However, this only applies when there is at least one bidder. If there are no DAI offers for a certain epoch, then nobody would be able to claim the batch of TempleGold tokens. Additionally, there is no recovery process implemented in the contract. The recoverToken() function only applies to auctions for the current epoch that are in the cooldown period.

Impact

Auctioned TempleGold tokens will be lost for epochs that have no bidders. The DaiGoldAuction contract doesn't implement any recovery process for these scenarios, leading to a potential loss of funds.

Tools Used

None.

Recommendations

Add an owner accessible function to recover tokens from auctions without bidders by checking that the given epoch has finished and that totalBidTokenAmount == 0.