search

code-423n4 / 2021-12-pooltogether-findings

0 stars 0 forks source link

getCurrentEpochId might behave unexpectedly #118

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Handle

certora

Vulnerability details

getCurrentEpochId might behave unexpectedly. getCurrentEpochId calls _getCurrentEpochId:

function _getCurrentEpochId(Promotion memory _promotion) internal  view  returns (uint256) {
    // elapsedTimestamp / epochDurationTimestamp
    return (block.timestamp - _promotion.startTimestamp) / _promotion.epochDuration;
}

If the promotion is over, it'll return an epoch that doesn't exist in the promotion.

Impact

any external call to getCurrentEpochId will behave unexpectedly if the promotion is over.

Recommended Mitigation Steps

revert if the promotion is over.

PierrickGT commented 2 years ago

Duplicate of https://github.com/code-423n4/2021-12-pooltogether-findings/issues/109