Setting Factory.auctionDecrement to zero causes Denial of Service in Auction.settleAuction()

[code423n4]

Handle

pants

Vulnerability details

The function Factory.setAuctionDecrement() allows the owner to set the state variable Factory.auctionDecrement to zero.

Impact

If Factory.auctionDecrement equals zero then the function Auction.settleAuction() will always revert due to a division by zero:

uint256 b = (bondBlock - auctionStart) * BASE / factory.auctionDecrement();

Tool Used

Manual code review.

Recommended Mitigation Steps

Add an appropriate require statement to the function Factory.setAuctionDecrement() to disallow setting Factory.auctionDecrement to zero.

[GalloDaSballo]

I agree with the finding, because this shows a way to DOS the protocol, given specific conditions, I will raise the severity to medium