Submission Details
Severity:
The `MAX_CONTEST_PERIOD` can't be changed
Summary
In the contract ProxyFactory the maximum period of the contest can't be changed. The message "close time must be less than 28 days from now" implies that it could be
Vulnerability Details
As MAX_CONTEST_PERIOD is a constant and cannot be changed, making it impossible to create contests with longer closings than 28 days:
065: uint256 public constant MAX_CONTEST_PERIOD = 28 days;
110: if (closeTime > block.timestamp + MAX_CONTEST_PERIOD || closeTime < block.timestamp) {
111: revert ProxyFactory__CloseTimeNotInRange();
112: }
Impact
The owner of ProxyFactory contract can't create contests with longer closings than 28 days
Recommendations
Add a onlyOwner function to set the MAX_CONTEST_PERIOD:
event SetContest(uint256 MAX_CONTEST_PERIOD);
function setContest(uint256 _MAX_CONTEST_PERIOD) external onlyOwner {
MAX_CONTEST_PERIOD = _MAX_CONTEST_PERIOD;
emit SetContest(_MAX_CONTEST_PERIOD);
}
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
19477 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.