BriVault
First Flight #52
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: medium
Invalid

Time Check Inconsistency Between Deposit and Join

yxsec

  • Deposit and join should close simultaneously at eventStartDate.

  • deposit reverts when block.timestamp >= eventStartDate, but joinEvent only reverts when strictly greater, creating a one-block window.

// src/briVault.sol
@>if (block.timestamp >= eventStartDate) revert eventStarted(); // deposit
...
@>if (block.timestamp > eventStartDate) revert eventStarted(); // joinEvent

Risk

Likelihood:

  • At the exact eventStartDate timestamp, the discrepancy always occurs.

  • MEV bots or attentive users can intentionally target that block.

Impact:

  • Users can switch teams at the start moment while new deposits are blocked, gaining unfair insight.

  • Tournament rules lose credibility.

Proof of Concept

vm.warp(eventStartDate);
vault.joinEvent(1); // succeeds
vault.deposit(...); // reverts

Recommended Mitigation

- if (block.timestamp > eventStartDate) {
+ if (block.timestamp >= eventStartDate) {
revert eventStarted();
}
Updates

Appeal created

bube Lead Judge 19 days ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!