TempleGold
TempleDAO
Foundry
25,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

`setRewardDistributionCoolDown` has no max bound, can be abused by admin

0xtheblackpanther

GitHub

https://github.com/Cyfrin/2024-07-templegold/blob/6c3980a0486c01114d0ef1281df188b6c01991e6/protocol/contracts/templegold/TempleGoldStaking.sol#L153-L157

Summary

The setRewardDistributionCoolDown function sets the reward distribution cooldown period. Currently, this function lacks a maximum bound, allowing the admin to set it to the maximum value of type(uint160).max. This could significantly impact the distributeRewards function. A malicious admin could set an extremely high cooldown value, effectively preventing users from distributing rewards. This would cause the distributeRewards function to always revert due to the following check:

if (lastRewardNotificationTimestamp + rewardDistributionCoolDown > block.timestamp)
{
revert CannotDistribute();
}

Impact

A malicious admin can set an excessively high cooldown value, forcing users to never be able to distribute the rewards. This would result in the distribution of TGLD rewards to stakers always reverting because of the cooldown check. Users would be forced to wait for an unreasonably long cooldown period, which can effectively disable the reward distribution mechanism.

Recommendation

Add a maximum bound to the rewardDistributionCoolDown value to prevent a malicious admin from setting it to an excessively high value.

Updates

Lead Judging Commences

inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

missing totalAuctionTokenAllocation deduction in removeAuctionConfig leads to stuck funds

Appeal created

inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.