Sparkn

Summary

The ProxyFactory::setContest function does not allow the governor to submit a deadline for their action. This missing feature enables pending transactions to be maliciously executed at a later point, shortening the duration of the contest.

Vulnerability Details

1. The transaction is submitted to the mempool, however, the Administrator chose a transaction fee that is too low for miners to be interested in including her transaction in a block. The transaction stays pending in the mempool for extended periods, which could be hours, days, weeks, or even longer.
   When the average gas fee dropped far enough for the Administrator transaction to become interesting again for miners to include it, the setContest function will be executed in an significant time delay. Shortening the supporters time to work on the contest.
   An even worse way this issue can be maliciously exploited is through MEV.

Impact

Worsened UX and protocol availability disrupted due to contest duration shortening.

Tools Used

Manual review.

Recommendations

Introduce a deadline parameter to the mentioned function, along with a check that requires that no more that a few minutes have passed.