Sparkn

CodeFox Inc.
DeFiFoundryProxy
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium

The `deployProxyAndDistribute` and `deployProxyAndDistributeBySignature` miss an important check

SanketKogekar

Summary

The deployProxyAndDistribute and deployProxyAndDistributeBySignature miss require check and could be triggered at incorrect timestamps.

Vulnerability Details

The deployProxyAndDistribute and deployProxyAndDistributeBySignature miss require check and could be triggered at incorrect timestamps.

if (saltToCloseTime[salt] + EXPIRATION_TIME > block.timestamp)

Please check the following functions:

function deployProxyAndDistribute(bytes32 contestId, address implementation, bytes calldata data)
public
returns (address)
{
bytes32 salt = _calculateSalt(msg.sender, contestId, implementation);
if (saltToCloseTime[salt] == 0) revert ProxyFactory__ContestIsNotRegistered();
// can set close time to current time and end it immediately if organizer wish
if (saltToCloseTime[salt] > block.timestamp) revert ProxyFactory__ContestIsNotClosed();
address proxy = _deployProxy(msg.sender, contestId, implementation);
_distribute(proxy, data);
return proxy;
}

and

function deployProxyAndDistributeBySignature(
address organizer,
bytes32 contestId,
address implementation,
bytes calldata signature,
bytes calldata data
) public returns (address) {
bytes32 digest = _hashTypedDataV4(keccak256(abi.encode(contestId, data)));
if (ECDSA.recover(digest, signature) != organizer) revert ProxyFactory__InvalidSignature();
bytes32 salt = _calculateSalt(organizer, contestId, implementation);
if (saltToCloseTime[salt] == 0) revert ProxyFactory__ContestIsNotRegistered();
if (saltToCloseTime[salt] > block.timestamp) revert ProxyFactory__ContestIsNotClosed();
address proxy = _deployProxy(organizer, contestId, implementation);
_distribute(proxy, data);
return proxy;
}

Impact

Missing checks could allows triggering function at incorrect times / EVM states.

Tools Used

Manual

Recommendations

Add the missing check:

if (saltToCloseTime[salt] + EXPIRATION_TIME > block.timestamp)

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.