Sparkn

Summary

Calls can be made to the proxy contract even after it expires, which does not align with what the documentation says,
"Proxy contracts are supposed to be disposed after the contest is over. If there is a need to upgrade the protocol, we will just create a new implementation contract and deploy proxies with the new implementation contract." This may lead to unexpected behaviour.

Vulnerability Details

The documentation states that the proxy contract is supposed to be "disposed" once the contest expires/comes to an end, however there is no functionality in the contract to dispose/discontinue the usage of the proxy contract. This is a serious issue because because:

1. The ProxyFactory.sol or Proxy.sol contract does not have any function that disposes off the proxy contract

2. All the calls to the proxy will still be allowed because the contract checks if the contest has ended to allow transactions. Since that is only condition that is checked, when the contest has ended, the transaction will be allowed to go through.

3. This is possible because there is no mechanism in place to avoid this from happening.

Impact

Calls made to the proxy contract may behave unexpectedly.

Tools Used

Manual Analysis

Recommendations

the proxy should be destructed after the funds have been distributed/ it should use a pause function to disallow calls made to it.