Closed code423n4 closed 2 years ago
WatchPug
The modifier onlyPromotionCreator is only used once in cancelPromotion(), it calls _getPromotion() which is dulpicate with the first line in cancelPromotion(), therefore, it can be inlined to make the code simplier and save some gas.
onlyPromotionCreator
cancelPromotion()
_getPromotion()
Change to:
https://github.com/pooltogether/v4-periphery/blob/0e94c54774a6fce29daf9cb23353208f80de63eb/contracts/TwabRewards.sol#L119-L138
function cancelPromotion(uint256 _promotionId, address _to) external override returns (bool) { Promotion memory _promotion = _getPromotion(_promotionId); require( msg.sender == _promotion.creator, "TwabRewards/only-promotion-creator" ); _requirePromotionActive(_promotion); require(_to != address(0), "TwabRewards/recipient-not-zero-address"); uint256 _remainingRewards = _getRemainingRewards(_promotion); delete _promotions[_promotionId]; _promotion.token.safeTransfer(_to, _remainingRewards); emit PromotionCancelled(_promotionId, _remainingRewards); return true; }
Duplicate of https://github.com/code-423n4/2021-12-pooltogether-findings/issues/77
Handle
WatchPug
Vulnerability details
The modifier
onlyPromotionCreator
is only used once incancelPromotion()
, it calls_getPromotion()
which is dulpicate with the first line incancelPromotion()
, therefore, it can be inlined to make the code simplier and save some gas.Recommendation
Change to:
https://github.com/pooltogether/v4-periphery/blob/0e94c54774a6fce29daf9cb23353208f80de63eb/contracts/TwabRewards.sol#L119-L138