Closed code423n4 closed 2 years ago
WatchPug
For unstarted promotions, cancelPromotion() will revert at block.timestamp - _promotion.startTimestamp in _getCurrentEpochId().
cancelPromotion()
block.timestamp - _promotion.startTimestamp
_getCurrentEpochId()
Call stack: getRemainingRewards() -> _getRemainingRewards() -> _getCurrentEpochId().
getRemainingRewards()
_getRemainingRewards()
https://github.com/pooltogether/v4-periphery/blob/0e94c54774a6fce29daf9cb23353208f80de63eb/contracts/TwabRewards.sol#L276-L279
function _getCurrentEpochId(Promotion memory _promotion) internal view returns (uint256) { // elapsedTimestamp / epochDurationTimestamp return (block.timestamp - _promotion.startTimestamp) / _promotion.epochDuration; }
Change to:
function _getCurrentEpochId(Promotion memory _promotion) internal view returns (uint256) { // elapsedTimestamp / epochDurationTimestamp if (block.timestamp <= _promotion.startTimestamp) { return 0 } return (block.timestamp - _promotion.startTimestamp) / _promotion.epochDuration; }
This issue has been fixed in the following issue. Duplicate of https://github.com/code-423n4/2021-12-pooltogether-findings/issues/101
Handle
WatchPug
Vulnerability details
For unstarted promotions,
cancelPromotion()
will revert atblock.timestamp - _promotion.startTimestamp
in_getCurrentEpochId()
.Call stack:
getRemainingRewards()
->_getRemainingRewards()
->_getCurrentEpochId()
.https://github.com/pooltogether/v4-periphery/blob/0e94c54774a6fce29daf9cb23353208f80de63eb/contracts/TwabRewards.sol#L276-L279
Recommendation
Change to: