BriVault
First Flight #52
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: high
Invalid

Setting the date variables only in the constructor, makes the app one-time use only.

farnad

Root + Impact

Description

  • The BriVault::eventStartDate and BriVault::eventEndDate variables are just set in the constructor function.

  • There is no other function which can be called by the owner to change these values for other events in the future.

constructor (IERC20 _asset, uint256 _participationFeeBsp, uint256 _eventStartDate, address _participationFeeAddress, uint256 _minimumAmount, uint256 _eventEndDate) ERC4626 (_asset) ERC20("BriTechLabs", "BTT") Ownable(msg.sender) {
if (_participationFeeBsp > PARTICIPATIONFEEBSPMAX){
revert limiteExceede();
}
participationFeeBsp = _participationFeeBsp;
@> eventStartDate = _eventStartDate;
@> eventEndDate = _eventEndDate;
participationFeeAddress = _participationFeeAddress;
minimumAmount = _minimumAmount;
_setWinner = false;
}

Risk

Likelihood: High

  • When the owner sets BriVault::eventStartDate and BriVault::eventEndDate variables by depolying the contract. They remain intact forever.

Impact: Low

  • Even though it does not break the program, it can be used only for 1 event. It restricts the usage of the program. And for running several events, several instances of this contract need to be deployed. Therefore, it can bloat the blockchain and make it difficult to handle multiple contracts in the front-end.

Proof of Concept

By looking at the contract, you see the function for changing the dates is missing.

// There is no function for changing the event dates after deployment

Recommended Mitigation

Please add the following code to the briVault.sol file.

+ function changeDates(uint256 _eventStartDate, uint256 _eventEndDate) external onlyOwner {
+ if(block.timestamp < eventStartDate || block.timestamp > eventEndDate){
+ eventStartDate = _eventStartDate;
+ eventEndDate = _eventEndDate;
+ } else
+ revert eventStarted();
+ }
+ }
​
Updates

Appeal created

bube Lead Judge 19 days ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!