Submission Details
Severity:
Inconsistent in comment and implementation
Summary
Inconsistent comment and implementation might mislead the developer.
Vulnerability Details
In the deployProxyAndDistribute function in ProxyFactory.sol, there is an one-line comment:
// can set close time to current time and end it immediately if organizer wish
and the function does not implement this feature and neither does the remaining contract.
function deployProxyAndDistribute(bytes32 contestId, address implementation, bytes calldata data)
public
returns (address)
{
bytes32 salt = _calculateSalt(msg.sender, contestId, implementation);
if (saltToCloseTime[salt] == 0) revert ProxyFactory__ContestIsNotRegistered();
// can set close time to current time and end it immediately if organizer wish
if (saltToCloseTime[salt] > block.timestamp) revert ProxyFactory__ContestIsNotClosed();
address proxy = _deployProxy(msg.sender, contestId, implementation);
_distribute(proxy, data);
return proxy;
}
Impact
It might mislead the auditor and the developer, since the implementation logic might be totally different.
Tools Used
Manual Detection
Recommendations
Remove the feature or implement it in another function.
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
19477 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.