TempleGold
TempleDAO
Foundry
25,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

There is no upper limit in TempleGoldStaking::setVestingPeriod() function for the period amount

tamer

Summary

No upper limit inside of TempleGoldStaking::setVestingPeriod() function.

Vulnerability Details

If by mistake the one that has elevatedAccess sets huge period of time, this could be unwanted situation. In the worst case scenario this could be 136 years.

Impact

The elevatedAccess sets a big amount of period in seconds that could go up to 136 years in the worst case since there is only a check for under a week.

Play this test inside TempleGoldStaking.t.sol::TempleGoldStakingTest

function test_setVestingPeriodForALongTime() public {
vm.startPrank(executor);
uint32 period = 1200 weeks; // 23 years
staking.setVestingPeriod(period);
// checks if the vesting period is set to 23 years
assertEq(staking.vestingPeriod(), period);
}

Tools Used

Manual Review

Recommendations

Add a constant variable that has reasonable upper bounds and check it inside the setVestingPeriod() function.

This is also the case for setRewardDuration() function right below the setVestingPeriod() function.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.