Submission Details
Severity:
Lack of checking for timestamp in `ContestManager::fundContest`, Onwer can fund contest even if claim deadline has passed.
Vulnerability Details:
The fundContest function do not have time checking and it allows owner to fund contest at any time even if claim deadline has passed.
Impact:
If the owner fund contest after claim deadline has passed, no one can claim their Cut.
Proof of Concept:
Paste this test into TestMyCut.t.sol, test will pass. The owner can fund the Pot contract after 91 days.
function test_canFundPotWhenDeadLinePass_PASS()
public
mintAndApproveTokens
{
vm.startPrank(user);
contest = ContestManager(conMan).createContest(
players,
rewards,
IERC20(ERC20Mock(weth)),
4
);
vm.warp(91 days);
ContestManager(conMan).fundContest(0);
}
Tools Used:
Manual review
Foundry
Recommendations:
Fund the contest immediately after it is created or set time for claiming begin from when the contest is funded.
Rewards breakdown
nSLOC
106This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.