BriVault
First Flight #52
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: low
Invalid

[M-01] Vault finalization depends on external timing guard

0xch1d3r4n

**Root + Impact **

function _setFinallizedVaultBalance() internal returns (uint256) {

if (block.timestamp <= eventStartDate) {

revert eventNotStarted();

}

finalizedVaultAsset = IERC20(asset()).balanceOf(address(this));

}


Description

Normal Behaviour: Vault finalization should only occur after the events ends.

Issue: The function only checks block.timestamp > eventStartDateand not eventEndDate

If called too early (eg. Through SetWinner()and finalisation captures incomplete funds or incorrect balances.

//@ if (block.timestamp <= eventStartDate) { revert eventNotStarted()

Risk

Likelihood:

  • Low - function is internal but callable indirectly by setWinner()

  • Can finalise vault prematurely if logic order is mishandled.

Impact:

  • High - Vault finalises before event truly ends.

  • Winners may receive incomplete prize pool

Proof of Concept

// Setup
vault = new BriVault(asset, 100, block.timestamp + 1 days, owner, 1e18, block.timestamp + 10 days);
​
// User deposits before event starts
vault.deposit(100e18, alice);
​
// Owner calls setWinner() before event ends
vm.warp(block.timestamp + 2 days);
vault.setWinner(1); // ✅ passes incorrectly because _setFinalizedVaultBalance() only checks startDate
​
// Effect:
// finalizedVaultAsset = 100e18 (current balance)
// But users may still deposit more before eventEndDate → real balance > finalizedVaultAsset
​

Recommended Mitigation

- if (block.timestamp <= eventStartDate) revert eventNotStarted();
+ if (block.timestamp <= eventEndDate) revert eventNotEnded();
​
Updates

Appeal created

bube Lead Judge 21 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!