` Distribution :: editPool` admin can can override pool data
Summary
front-run users
Vulnerability Details
admin can front-run user before they withdraw funds by extending the payoutStart ,withdrawLockPeriod, withdrawLockPeriod
andclaimLockPeriod every time they see that withdrawals are due.
Impact
can be used to lock funds in the protocol. lose of funds and user can get less rewards.
Tools Used
manual
Recommendations
before updating pool data the function editPool should compare all old values and
the new values and update some variables only if you are not overring old variables with
zero's in the new pool values. The must be a time limit for making pool edit for a pool created and after that time has passed the admin
can not edit the pool.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.