Root + Impact

Description

The `createPerformance()` function does not enforce maximum limits on `duration` or `reward` parameters. While the function validates that these values are greater than zero, extremely large values could cause integer overflow in calculations or create unintended economic behavior.
The normal behavior should validate that duration and reward amounts are within reasonable bounds to prevent edge cases and potential overflow issues.

```solidity

function createPerformance(

uint256 startTime,

uint256 duration,

uint256 reward

) external onlyOrganizer returns (uint256) {

require(startTime > block.timestamp, "Start time must be in the future");

require(duration > 0, "Duration must be greater than 0"); // @> No maximum limit

// @> No validation on reward amount

performances[performanceCount] = Performance({

startTime: startTime,

    endTime: startTime + duration, *// @> Could overflow if duration is extremely large*

    baseReward: reward *// @> No maximum limit*

});

}

```

Risk

Likelihood:

• * Organizer can set any duration and reward amount

  * Accidental or malicious configuration of extreme values

  * While Solidity 0.8.25 has overflow protection, extremely large values still cause issues

Impact:

• * Potential integer overflow in `startTime + duration` calculation

  * Unintended economic behavior with extremely large rewards

  * Gas issues when processing large reward amounts

  * Potential DoS if reward calculation exceeds gas limits

Proof of Concept

Recommended Mitigation