Sparkn

CodeFox Inc.
DeFiFoundryProxy
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium

Organizers can distribute even after contests are expired

0xstuart

Summary

Organizers can distribute even after contests have expired

Vulnerability Details

After a contest has expired, the permission to distribute gets handed over to the owner, so only the owner should be able to distribute after the expiration.

But expiration checking is missing in deployProxyAndDistribute() and deployProxyAndDistributeBySignature() in ProxyFactory contract, organizers are able to distribute even after their contests have expired.

Impact

There might be an unexpected distribution after a contest has expired.

Tools Used

Manual Review

Recommendations

I'd suggest adding expiration checks to deployProxyAndDistribute() and deployProxyAndDistributeBySignature() in ProxyFactory contract.

function deployProxyAndDistribute(bytes32 contestId, address implementation, bytes calldata data)
public
returns (address)
{
... ...
if (saltToCloseTime[salt] > block.timestamp) revert ProxyFactory__ContestIsNotClosed();
​
// --> Here, add the following line
if (saltToCloseTime[salt] + EXPIRATION_TIME <= block.timestamp) revert ProxyFactory__ContestIsExpired();
... ...
}

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.