BriVault
First Flight #52
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: high
Invalid

CRITICAL-03: Constructor Missing Critical Validation Allows Broken Contract Deployment

mostafapahlevani93

Root + Impact

The constructor lacks validation for critical parameters including date ordering, zero addresses, and minimum amounts. This allows deployment of a non-functional contract that cannot be salvaged.

Description

Normal behavior expects the constructor to validate that event dates are logically ordered (start > current time, end > start), that addresses are not zero, and that minimum amounts are reasonable.

The current implementation only validates the participation fee cap but allows deployment with past dates, zero addresses for fee collection, inverted date ordering, and zero minimum amounts.

constructor(
IERC20 _asset,
uint256 _participationFeeBsp,
// @> No validation that _eventStartDate > block.timestamp
uint256 _eventStartDate,
// @> No validation that _participationFeeAddress != address(0)
address _participationFeeAddress,
// @> No validation that _minimumAmount > 0
uint256 _minimumAmount,
// @> No validation that _eventEndDate > _eventStartDate
uint256 _eventEndDate
) ERC4626(_asset) ERC20("BriTechLabs", "BTT") Ownable(msg.sender) {
if (_participationFeeBsp > PARTICIPATIONFEEBSPMAX) {
revert limiteExceede();
}
​
participationFeeBsp = _participationFeeBsp;
// @> These assignments occur without validation
eventStartDate = _eventStartDate;
eventEndDate = _eventEndDate;
participationFeeAddress = _participationFeeAddress;
minimumAmount = _minimumAmount;
_setWinner = false;
}

Risk

Likelihood:

  • Deployment scripts with incorrect configuration values will succeed without warning

  • Manual deployments during testing with placeholder values can accidentally go to mainnet

  • No on-chain mechanism to fix these values after deployment

  • Time zone confusion or typo in timestamps will not be caught

Impact:

  • If eventStartDate is in the past, users can never deposit (always reverts with eventStarted())

  • If eventEndDate < eventStartDate, winner can never be set or logic breaks

  • If participationFeeAddress is zero address, all fees are lost/burned on transfer

  • If minimumAmount is zero, users can make dust deposits breaking economics

  • Entire contract deployment and associated costs are wasted

  • Protocol reputation damaged if deployed to mainnet with broken config

  • No upgrade mechanism means complete redeployment required

Proof of Concept

// Deploy with start date in past
BriVault vault = new BriVault(
IERC20(address(token)),
100,
block.timestamp - 1 days, // Already passed!
address(0x123),
100e18,
block.timestamp + 10 days
);
​
// Try to deposit - always fails
vault.deposit(1000e18, user); // Reverts: eventStarted()
// Contract is permanently broken
​
// ----
​
// Deploy with inverted dates
vault = new BriVault(
IERC20(address(token)),
100,
block.timestamp + 10 days, // Start
address(0x123),
100e18,
block.timestamp + 1 days // End before start!
);
​
// Logic completely broken - can't set winner correctly
​
// ----
​
// Deploy with zero address fee collector
vault = new BriVault(
IERC20(address(token)),
100,
block.timestamp + 1 days,
address(0), // Fees sent to black hole
100e18,
block.timestamp + 10 days
);
​
// All participation fees permanently lost

Recommended Mitigation

constructor(
IERC20 _asset,
uint256 _participationFeeBsp,
uint256 _eventStartDate,
address _participationFeeAddress,
uint256 _minimumAmount,
uint256 _eventEndDate
) ERC4626(_asset) ERC20("BriTechLabs", "BTT") Ownable(msg.sender) {
if (_participationFeeBsp > PARTICIPATIONFEEBSPMAX) {
revert limiteExceede();
}
+ // Validate dates are in future and properly ordered
+ require(_eventStartDate > block.timestamp, "Start date must be in future");
+ require(_eventEndDate > _eventStartDate, "End date must be after start date");
+
+ // Validate addresses
+ require(_participationFeeAddress != address(0), "Invalid fee address");
+ require(address(_asset) != address(0), "Invalid asset address");
+
+ // Validate minimum amount
+ require(_minimumAmount > 0, "Minimum amount must be positive");
​
participationFeeBsp = _participationFeeBsp;
eventStartDate = _eventStartDate;
eventEndDate = _eventEndDate;
participationFeeAddress = _participationFeeAddress;
minimumAmount = _minimumAmount;
_setWinner = false;
}
Updates

Appeal created

bube Lead Judge 19 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Missing Constructor Validation

This is owner action and the owner is assumed to be trusted and to provide correct input arguments.

mostafapahlevani93 Submitter
18 days ago
bube Lead Judge
15 days ago
bube Lead Judge 14 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Missing Constructor Validation

This is owner action and the owner is assumed to be trusted and to provide correct input arguments.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!