Sparkn

Summary

organizer can invoke the function past the EXPIRATION_TIME.

Vulnerability Details

Upon the completion of the MAX_CONTEST_PERIOD, the organizer is permitted to trigger the deployProxyAndDistribute or deployProxyAndDistributeBySignature functions. However, the deployProxyAndDistributeByOwner function can only be called by owner once the EXPIRATION_TIME period has elapsed.

To date, these functions have been operating as expected. However, an issue arises where the organizer can still trigger the function even after the EXPIRATION_TIME has ended.

According to the Sequence Diagram of the Protocol provided in the README and all other documentation, this should not occur. It is specified that only the organizer has the authority to call the dispatch function only in the period between MAX_CONTEST_PERIOD expiration and less than EXPIRATION_TIME.

Impact

The protocol still working for the organizer even the contest pass the EXPIRATION_TIME. The funds can be send.

Tools Used

Manual code review.

Recommendations

Set a condition like that: