Sparkn

CodeFox Inc.
DeFiFoundryProxy
15,000 USDC
View results
Submission Details
Severity: medium

Lack minimum contest time period

Summary

There is no minimum value set for contest only maximum value is set

Vulnerability Details

This implies as block.timestamp is an increasing function with time, immediately after a contest is set the functions
deployProxyAndDistribute(); deployProxyAndDistributeBySignature(); can be called if closeTime entered in setContest() was a value just slightly above block.timestamp used in setContest()

Impact

It may be reasonable to have a minimum period before which deploy and distributions cant be called by owner or organizer. It makes the system more easier to reason about and more reflective given that it has a Maximum Contest Period a Minimum should flow logically

Say for example contest is set and there are two sponsors. SponsorA deposits funds into contest, but sponsorB delays deposits. Owner or organizers when winners finalized immediately call deployProxyAndDistribute() or deployProxyAndDistributeBySignature() to distribute to winners andsoon after delaying sponsorB deposits their amount, this will only distribute SponsorA funds whereas owner or organizer may be thinking sponsorB should have also deposited by now if they didn't check balances. Therefore a minimum period can allow for the above or any other aspects like time to change winners etc

Tools Used

Manual Analysis

Recommendations

It is recommended to set a contest minimum period e.g

uint256 public constant MIN_CONTEST_PERIOD = 2 days;
mapping(bytes32 => uint256) public saltToSetTime; //time when contest was set
// set time in setContest() function
saltToCloseTime[salt] = closeTime;
saltToSetTime[salt] = block.timestamp;
// usage within relevant functions apply below check
if ( saltToSetTime[salt] < 2 days + block.timestamp ) revert ProxyFactory__ContestIsNotOpen();

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.