You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The auctionPeriod is not initialized on the creation of a Pool. This will allow user to create new auctions with auctionPeriod==0 because 0 is the default value.
Internal Pre-conditions
auctionPeriod not initialized using the dedicated function (auctionPeriod==0)
External Pre-conditions
None.
Attack Path
User create an auction with a 0s duration
Impact
Users can create auctions with no duration because is auctionPeriod==0.
Mitigation
Initialize the auctionPeriod variable in the Poool::initialize function
The text was updated successfully, but these errors were encountered:
Stable Brick Swan
Medium
auctionPeriod
variable not initializedSummary
The
auctionPeriod
is not correctly initialized when at the creation of thePool
allowing user to create auction with aauctionPeriod==0
Relevant GitHub Links
https://github.com/sherlock-audit/2024-12-plaza-finance/blob/main/plaza-evm/src/Pool.sol#L135-L170
https://github.com/sherlock-audit/2024-12-plaza-finance/blob/main/plaza-evm/src/Pool.sol#L535
Root Cause
The
auctionPeriod
is not initialized on the creation of a Pool. This will allow user to create new auctions withauctionPeriod==0
because0
is thedefault value
.Internal Pre-conditions
auctionPeriod
not initialized using the dedicated function (auctionPeriod==0
)External Pre-conditions
None.
Attack Path
User create an auction with a
0s
durationImpact
Users can create auctions with no duration because is
auctionPeriod==0
.Mitigation
Initialize the
auctionPeriod
variable in thePoool::initialize
functionThe text was updated successfully, but these errors were encountered: