Sparkn

Summary

Signatures signed by the organizer in the deployProxyAndDistributeBySignature function lack an expiration timestamp, potentially leading to unauthorized access and misuse. A missing expiration timestamp allows the signed message to remain valid indefinitely, which enables the signer to retain control beyond the intended timeframe.

Vulnerability Details

The vulnerability arises from the absence of an expiration timestamp in the signature verification process within the deployProxyAndDistributeBySignature function. EIP-712, which is utilized for signature verification, does not inherently include an expiration date for signatures. This omission leaves the decision of implementing an expiration mechanism to the application layer or the contract itself.

Without an expiration parameter, a user who signs a message essentially grants a "lifetime license" to the signed action. In the context of the given code, this means that once an organizer signs a message to deploy a proxy and distribute prizes, the signature remains valid indefinitely. This allows the organizer to exercise control beyond the originally intended timeframe of the contest.

Impact

The absence of an expiration timestamp for signatures signed by organizers may lead to unauthorized access. Without an expiration mechanism, the signed message remains valid indefinitely, allowing the signer to retain control beyond the intended timeframe.

Tools Used

Manual Review

Recommendations

To mitigate this vulnerability, it is recommended to incorporate an expiration parameter within the signed message. By introducing a timestamp deadline, the contract can ensure that signatures have a limited validity period. This will help prevent long-term misuse and provide better control over the lifecycle of signed actions.