Submission Details
Severity:
editPool is not checking for payoutStart
Summary
When a pool is created with createPool there is a check if the payoutStart is in the future.
This can be worked around with the editPool function.
Vulnerability Details
In createPool there is the following check:
require(pool_.payoutStart > block.timestamp, "DS: invalid payout start value");
This can be worked around by directly editing the pool after the creation, and set the payoutStart to an earlier timestamp. This works because editPool is lacking this check. This can even be done in the same transaction.
Impact
Pool can be created with payoutStart time in the past.
Tools Used
n/a
Recommendations
Add the same check for the payoutStart to the editPool function.
Updates
Lead Judging Commences
inallhonesty over 1 year ago
Submission Judgement Published Assigned finding tags:
`editPool` function doesn't do the payoutStart check
Prize pool breakdown
Total prize
22,500 USDC
nSLOC
1,05421 USDC / LOC
20,000 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.