BriVault
First Flight #52
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: low
Invalid

endDate before startDate allows immediate winner selection

neomartis

endDate before startDate allows immediate winner selection

Description

  • Normal behavior: The event should have a valid time window with eventStartDate < eventEndDate. The winner should only be set after the event ended.

  • Issue: The constructor does not validate temporal invariants. If eventEndDate < eventStartDate, the owner can set the winner right after the (earlier) end date passes, effectively eliminating the event window while deposits and joins still occurred before eventStartDate.

// @> constructor sets start and end without validation
constructor (IERC20 _asset, uint256 _participationFeeBsp, uint256 _eventStartDate, address _participationFeeAddress, uint256 _minimumAmount, uint256 _eventEndDate) ERC4626 (_asset) ERC20("BriTechLabs", "BTT") Ownable(msg.sender) {
...
eventStartDate = _eventStartDate;
eventEndDate = _eventEndDate;
...
}

Risk

Likelihood: Low

  • Requires misconfiguration at deployment.

Impact: Low

  • Eliminates the intended event window; users can join but the owner can finalize immediately after the earlier end date.

Proof of Concept

Description:

  • Deploy vault with eventEndDate < eventStartDate.

  • User deposits and joins before eventStartDate.

  • After time reaches eventStartDate, owner can immediately set the winner since eventEndDate already passed.

function testEndDateBeforeStartDate() public {
// End date is before start date
eventStartDate = block.timestamp + 2 days;
eventEndDate = block.timestamp;
​
vm.startPrank(owner);
briVault = new BriVault(
IERC20(address(mockToken)),
participationFeeBsp,
eventStartDate,
participationFeeAddress,
minimumAmount,
eventEndDate
);
briVault.setCountry(countries);
vm.stopPrank();
​
// User can deposit and join prior to start
vm.startPrank(user1);
mockToken.approve(address(briVault), 5 ether);
briVault.deposit(1 ether, user1);
briVault.joinEvent(8);
vm.stopPrank();
​
// Owner can set the winner immediately after start since end date already passed
vm.warp(eventStartDate + 1);
vm.startPrank(owner);
briVault.setWinner(8);
vm.stopPrank();
}

Recommended Mitigation

  • Validate time invariants in the constructor (and any admin updaters if added later).

constructor (
IERC20 _asset,
uint256 _participationFeeBsp,
uint256 _eventStartDate,
address _participationFeeAddress,
uint256 _minimumAmount,
uint256 _eventEndDate
) ERC4626 (_asset) ERC20("BriTechLabs", "BTT") Ownable(msg.sender) {
+ require(_eventStartDate > block.timestamp, "start in past");
+ require(_eventEndDate > _eventStartDate, "end must be after start");
...
eventStartDate = _eventStartDate;
eventEndDate = _eventEndDate;
...
}
Updates

Appeal created

bube Lead Judge 19 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Missing Constructor Validation

This is owner action and the owner is assumed to be trusted and to provide correct input arguments.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!