MorpheusAI

Summary

Absence of payoutStart check at the editPool function may lead to instantly changing of pools' key parameters. This can cause different problems such as incorrect rewards calculation and time lock changing.

Vulnerability Details

The createPool checks the payoutStart value:

The payoutStart influences on the reward calculation, withdrawal and claiming possibilities.

But the editPool function has no similar check. This way key parameters of pools can be instantly changed because of a mistake.

Impact

Incorrect reward calculation. Users will receive less rewards or won't receive rewards at all. Instant changing of withdrawal (in public pools) and claiming possibilities due to changing pool.payoutStart + pool.withdrawLockPeriod and pool.payoutStart + pool.claimLockPeriod timestamps.

Tools used

Manual Review

Recommendations

Consider checking that a new payoutStart parameter is the same as the old one.