Submission Details
Severity:
withdraw() needs to add a time access check
Summary
**withdraw() needs to check if the function is getting called before or after the deadline, to ensure the host can only withdraw the funds after the deadline is over. **
Impact
Without any time access check, a malicious host can remove all the funds from the contract with a single function call before the deadline is over. Resulting in loss of user funds and a breach to the protocol logic.
Tools Used
Manual Review
Recommendations
Add a check at the beginning of the withdraw() method, to ensure that the function can only be accessed after the deadline has crossed.
require(block.timestamp > deadline, "Withdrawal not allowed before deadline");
Updates
Lead Judging Commences
0xtimefliez about 1 year ago
Submission Judgement Published Assigned finding tags:
withdraw is callable before deadline ends
Rewards breakdown
nSLOC
129This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.