Submission Details
Impact:
Likelihood:
Owner Can Extend Expiry When Agreement Is Already in Terminal or Blocked State leads to no staker can ever stake
Author Revealed upon completion
Summary
setExpiry() does not check the current agreement state. If the agreement is already in PRODUCTION, CORRUPTED, or PROMOTION_REQUESTED, extending expiry serves no purpose, because staking is permanently blocked in these states.
Root Cause
function setExpiry(uint256 newExpiry) external onlyOwner {
if (expiryLocked) revert ExpiryLocked();
// No agreement state check
if (newExpiry < block.timestamp + _MIN_EXPIRY_LEAD) revert ExpiryTooSoon();
...
}
Staking is always blocked in these states regardless of expiry:
function _assertDepositsAllowed(IAttackRegistry.ContractState state) private pure {
if (
state == IAttackRegistry.ContractState.PROMOTION_REQUESTED
|| state == IAttackRegistry.ContractState.PRODUCTION
|| state == IAttackRegistry.ContractState.CORRUPTED
) {
revert StakingClosed(); // staking blocked regardless of expiry
}
}
Impact
No staker can ever stake regardless of new expiry. Misleading pool state, appears active but functionally dead.
Prize pool breakdown
Total prize
7.25 ETH
nSLOC
5890
ETH / LOC
6
1.25
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.
Rewards Distribution
The contest is complete and the rewards are being distributed.