MorpheusAI
MorpheusAI
Foundry
22,500 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

The function `editPool` lacks validation for the parameter `payoutStart`

Krace

Summary

The editPool function fails to verify that pool_.payoutStart is greater than the current block.timestamp, thereby violating the constraints established during pool creation. This allows the owner to promptly modify payoutStart through editPool right after creating the pool, effectively bypassing the check in createPool.

Vulnerability Details

When the owner creates new pools using createPool, it ensures that pool_.payoutStart is greater than the block.timestamp.

function createPool(Pool calldata pool_) public onlyOwner {
require(pool_.payoutStart > block.timestamp, "DS: invalid payout start value");
​
_validatePool(pool_);
pools.push(pool_);
​
emit PoolCreated(pools.length - 1, pool_);
}

However, in the editPool function, there are no checks for pool_.payoutStart. This allows the owner to freely modify pool_.payoutStart to any time, even if it is less than block.timestamp.

function editPool(uint256 poolId_, Pool calldata pool_) external onlyOwner poolExists(poolId_) {
_validatePool(pool_);
require(pools[poolId_].isPublic == pool_.isPublic, "DS: invalid pool type");
​
PoolData storage poolData = poolsData[poolId_];
uint256 currentPoolRate_ = _getCurrentPoolRate(poolId_);
​
// Update pool data
poolData.rate = currentPoolRate_;
poolData.lastUpdate = uint128(block.timestamp);
​
pools[poolId_] = pool_;
​
emit PoolEdited(poolId_, pool_);
}

Impact

The owner has the ability to create pools with a payoutStart less than the current block.timestamp.

Tools Used

Manual Review

Recommendations

Add a check in the function editPool:

diff --git a/contracts/Distribution.sol b/contracts/Distribution.sol
index ed18d59..c231c04 100644
--- a/contracts/Distribution.sol
+++ b/contracts/Distribution.sol
@@ -80,6 +80,7 @@ contract Distribution is IDistribution, OwnableUpgradeable, UUPSUpgradeable {
}
​
function editPool(uint256 poolId_, Pool calldata pool_) external onlyOwner poolExists(poolId_) {
+ require(pool_.payoutStart > block.timestamp, "DS: invalid payout start value");
_validatePool(pool_);
require(pools[poolId_].isPublic == pool_.isPublic, "DS: invalid pool type");
Updates

Lead Judging Commences

inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

`editPool` function doesn't do the payoutStart check

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.