Christmas Dinner
First Flight #31
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

M-01: Deadline Validation Vulnerability in setDeadline Function

_okchev

Summary

The setDeadline function contains a vulnerability that allows the host to overwrite the deadline multiple times, violating the intended one-time setup restriction. Additionally, there is no validation on the maximum value of _days, which can lead to unreasonably long deadlines.

Vulnerability Details

  1. Improper State Update:

    • The deadlineSet flag is not updated to true after successfully setting the deadline.

    • This allows the setDeadline function to be called repeatedly, overwriting the deadline.

  2. Missing Input Validation:

    • There is no check to ensure that _days is within a reasonable range. This can lead to excessively long deadlines, potentially causing logical or operational issues.

Impact

  • The host can repeatedly call setDeadline to change the deadline, contrary to the intended design of a one-time deadline setup.

  • Setting an unreasonably long deadline could disrupt the system's usability and predictability.

Tools Used

Manual code review for validation and logical flow.

Recommendations

  • Ensure the deadlineSet flag is updated to true after setting the deadline.

  • Validate _days to ensure it is a positive number and does not exceed a sensible maximum.

  • Use a constant for the maximum deadline duration for better maintainability and clarity.

// Custom errors for validation
error DaysMustBeGreaterThanZero();
error DeadlineExceedsMaximumAllowed(uint256 maxDays);
// Define Constant
uint256 public constant MAX_DEADLINE_DAYS = 365;
​
function setDeadline(uint256 _days) external onlyHost {
if (deadlineSet) {
revert DeadlineAlreadySet();
}
if (_days == 0) {
revert DaysMustBeGreaterThanZero();
}
if (_days > MAX_DEADLINE_DAYS) {
revert DeadlineExceedsMaximumAllowed(MAX_DEADLINE_DAYS);
}
​
deadline = block.timestamp + _days * 1 days;
deadlineSet = true; // Update the flag
emit DeadlineSet(deadline);
}
Updates

Lead Judging Commences

0xtimefliez Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

deadline is never set to true

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!