Submission Details
Severity:
Pool can be allowed to set invalid payout start with `editPool` function
Vulnerability Details
The function createPool checks if the payout start time is valid or not with the check require(pool_.payoutStart > block.timestamp), but this can be bypassed through the editPool function.
Tools Used
Manual Review
Recommendations
Enforce the following check in editPool function:
require(pool_.payoutStart > block.timestamp, "DS: invalid payout start value");
Updates
Lead Judging Commences
inallhonesty
over 1 year ago
inallhonesty over 1 year ago
Submission Judgement Published Assigned finding tags:
`editPool` function doesn't do the payoutStart check
Prize pool breakdown
Total prize
22,500 USDC
nSLOC
1,05421 USDC / LOC
20,000 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.