Submission Details
Severity:
Unprotected Deadline Extension
Description: While setDeadline can only be called once, it allows setting an arbitrarily long deadline.
The actual vulnerability is found here:
function setDeadline(uint256 _days) external onlyHost {
if(deadlineSet) {
revert DeadlineAlreadySet();
} else {
deadline = block.timestamp + _days * 1 days;
emit DeadlineSet(deadline);
}
}
Impact:
Potential indefinite fund lock
Trust exploitation
User fund inaccessibility
Recommended Mitigation: Add a maximum deadline limit:
uint256 public constant MAX_DEADLINE_DAYS = 30;
function setDeadline(uint256 _days) external onlyHost {
require(_days <= MAX_DEADLINE_DAYS, "Deadline too far in future");
require(_days > 0, "Deadline must be future date");
if(deadlineSet) {
revert DeadlineAlreadySet();
}
deadline = block.timestamp + _days * 1 days;
deadlineSet = true;
emit DeadlineSet(deadline);
}
Rewards breakdown
nSLOC
129This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.