MorpheusAI
MorpheusAI
Foundry
22,500 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Distribution.sol :: editPool() not checks if the payoutStart > block.timestamp.

ivanfitro

Summary

editPool() allows for the modification of pool parameters. However, it lacks a check to ensure that the payoutStart > block.timestamp, unlike in createPool().

Vulnerability Details

editPool() is employed to modify parameters of an existing pool.

function editPool(uint256 poolId_, Pool calldata pool_) external onlyOwner poolExists(poolId_) {
_validatePool(pool_);
require(pools[poolId_].isPublic == pool_.isPublic, "DS: invalid pool type");
​
PoolData storage poolData = poolsData[poolId_];
uint256 currentPoolRate_ = _getCurrentPoolRate(poolId_);
​
// Update pool data
poolData.rate = currentPoolRate_;
poolData.lastUpdate = uint128(block.timestamp);
​
pools[poolId_] = pool_;
​
emit PoolEdited(poolId_, pool_);
}

The issue lies in the absence of a check to ensure that payoutStart > block.timestamp, a condition verified in the createPool().

require(pool_.payoutStart > block.timestamp, "DS: invalid payout start value");

This can provocates a situation where users can instantly claim rewards if the block.timestamp is very small.

Impact

Users can instantly claim rewards as soon as the pool is created.

Tools Used

Manual review.

Recommendations

Add the require from createPool() into editPool().

function editPool(uint256 poolId_, Pool calldata pool_) external onlyOwner poolExists(poolId_) {
_validatePool(pool_);
require(pools[poolId_].isPublic == pool_.isPublic, "DS: invalid pool type");
+ require(pool_.payoutStart > block.timestamp, "DS: invalid payout start value");
​
PoolData storage poolData = poolsData[poolId_];
uint256 currentPoolRate_ = _getCurrentPoolRate(poolId_);
​
// Update pool data
poolData.rate = currentPoolRate_;
poolData.lastUpdate = uint128(block.timestamp);
​
pools[poolId_] = pool_;
​
emit PoolEdited(poolId_, pool_);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

`editPool` function doesn't do the payoutStart check

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.