Sparkn

Summary

While ProxyFactory.setContest() does validate the contest closeTime argument, it allows the closeTime to be set arbitrarily close to block.timestamp. Because it is not practical for a contest to last an extremely small amount of time such as 1 second, setContest() should validate closeTime to guarantee a reasonable minimum contest length and protect against bad input.

Vulnerability Details

The above code is how setContest() validates closeTime. This check allows closeTime to be set very close or even equal to block.timestamp. If a bad input is given, the contest may last 0 seconds or another very small period of time such as 5 seconds.

Impact

Bad input can cause the contest to end too soon. This may cause confusion among organizers, sponsors, and supporters. Funds are not directly at risk since any funds sent to the invalid contest can be recovered by the organizer.

Tools Used

Manual Review

Recommendations

Implement a minimum contest duration. For example, change closeTime < block.timestamp to closeTime < block.timestamp + 1 days.