Submission Details
Severity:
Missing Time Validation
Summary
The createVestingSchedule function lacks timestamp validation, allowing vesting schedules to be created with past start times.
Vulnerability Details
No validation exists to ensure startTime is in the future:
// Missing validation
// if (startTime < block.timestamp) revert InvalidStartTime();
Impact
Potential immediate token releases through backdated schedules
Compromised vesting mechanics
Unintended token distribution timing
Tools Used
Manual code review
Functional analysis
Recommendations
Add timestamp validation:
if (startTime < block.timestamp) revert InvalidStartTime();
Include validation testing
Log invalid timestamp attempts
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.