Sparkn

Summary

The configuration settings for the ProxyFactory.sol contract cannot be changed, forcing a redeploy in case the configuration needs to be tweaked.

Vulnerability Details

Unlike the Distributor contract, whose implementation can be changed later for future contests, the factory contract is a non-upgradeable singleton contract that serves as the main entrypoint of the protocol. This contract contains a set of configuration variables that are defined at construction time and cannot be changed during the lifetime of the contract. Both EXPIRATION_TIME and MAX_CONTEST_PERIOD are constant variables, and the set of whitelisted tokens present in the whitelistedTokens mapping is only defined in the contract's constructor, without providing any mutator to allow future modifications.

If any of these settings needs to be tweaked, it will force a redeployment of the contract, eventually needing to deal with multiple entry points for the protocol.

Impact

Low. Configuration values are constant and can't be changed if needed.

Tools Used

None.

Recommendations

Change the expiration time and max contest period settings to storage variables and allow the owner of the contract to change them via setters. Provide mutators for the whitelistedTokens mapping in case the list of supported tokens needs to be expanded.