BriVault
First Flight #52
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: high
Invalid

Event Dates Set in Constructor Prevent Reusability, Forcing Costly Redeployment

bigchapo21

Root + Impact

Description

  • The protocol is designed to be an event participation event, where user's join and at the end of the event, owner sets winner, and users who bet correctly win some shares

  • The protocol is hardcoded to be a single-use contract instance. The critical event timeline variables, such as eventStartDate and eventEndDate, are initialized exclusively within the constructor and cannot be modified or reset once deployed. Furthermore, there is no owner function to clear the internal state (like the usersAddress array or totalParticipantShares) after the event concludes and the winner is declared.

​
constructor (IERC20 _asset, uint256 _participationFeeBsp, uint256 _eventStartDate, address _participationFeeAddress, uint256 _minimumAmount, uint256 _eventEndDate) ERC4626 (_asset) ERC20("BriTechLabs", "BTT") Ownable(msg.sender)
if (_participationFeeBsp > PARTICIPATIONFEEBSPMAX){
revert limiteExceede();
}
participationFeeBsp = _participationFeeBsp;//set participation fee
eventStartDate = _eventStartDate;// set event start date
eventEndDate = _eventEndDate;// set event end date
participationFeeAddress = _participationFeeAddress;// set participation fee address
minimumAmount = _minimumAmount;// set minimum amount to join
_setWinner = false;// initialize winner not set
}

Risk

Likelihood:

  • When the contract is deployed

Impact:

  • For every new event the protocol wishes to host, the owner must pay the full gas cost to deploy an entirely new contract, including all the logic. This is highly inefficient and expensive.

  • All historical data, analytics, and user relationships are siloed in the old contract instance, preventing the accumulation of protocol history.

Proof of Concept

​

Recommended Mitigation

- remove this code
+ add this code
Introduce a 'resetEvent' function that handles cleanup and preparation for next event
Updates

Appeal created

bube Lead Judge 19 days ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!