Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Maturity Date Manipulation Risk Due to Missing Validation

princekay

Description

The ZENO token contract's constructor currently lacks crucial validation for the MATURITY_DATE parameter. While the date becomes immutable after deployment, the absence of proper validation during construction could allow the setting of invalid values, potentially compromising the entire redemption functionality of the contract.

Affected code

constructor(
address _usdc,
uint256 _maturityDate,
string memory _name,
string memory _symbol,
address _initialOwner
) Ownable(_initialOwner) ERC20(_name, _symbol) {
USDC = IERC20(_usdc);
MATURITY_DATE = _maturityDate;
}

Vulnerability details

The current implementation accepts any timestamp value for MATURITY_DATE without validation. This could result in the maturity date being set to a past date accidentally, or to an unreasonably distant future date. Such a scenario could permanently break the redemption functionality, as the isRedeemable() check would either always return true (for past dates) or false (for distant future dates). This vulnerability is particularly concerning because the immutable nature of the MATURITY_DATE means it cannot be corrected after deployment.

Tools Used

Manual Review

Recommended Mitigation Steps

The contract should implement strict validation in the constructor to ensure the MATURITY_DATE is set to a reasonable and valid value. This validation should include checks for minimum and maximum bounds, ensuring the date is in the future but not unreasonably distant. Here's the recommended implementation:

constructor(
address _usdc,
uint256 _maturityDate,
string memory _name,
string memory _symbol,
address _initialOwner
) Ownable(_initialOwner) ERC20(_name, _symbol) {
require(_maturityDate > block.timestamp, "Maturity date must be in future");
require(_maturityDate < block.timestamp + 10 years, "Maturity date too far");
USDC = IERC20(_usdc);
MATURITY_DATE = _maturityDate;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.