Sparkn

CodeFox Inc.
DeFiFoundryProxy
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium

Missing input validation checks on setContest `ProxyFactory.sol`

Sabelo

Summary

Some external functions like setContest are missing input validation which could lead to unexpected behaviors.

Vulnerability Details

The setContest function does not validate the contestId parameter which is passed in as bytes32. This could allow setting contests with unexpected IDs.

Impact

Lack of input validation could allow unexpected contests to be created or arbitrary logic to be executed in the proxy contracts. could lead to contests that cannot be managed or tracked properly. Users may be unable to lookup contest details or handle events as expected.

Tools Used

Manual

Recommendations

Validate contestId conforms to expected format with a modifier or require statement in setContest. Reject malformed values.

function setContest(address organizer, bytes32 contestId, uint256 closeTime, address implementation) public onlyOwner {
​
// Require contestId to match expected format
require(isValidContestId(contestId), "Invalid contestId format");
​
// Rest of function...
}
​
function isValidContestId(bytes32 contestId) pure returns (bool) {
// Check contestId format
return contestId[0] == 0x123;
}
​

Recommendations

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.