The creator can cancel the extended promotion. Anyone can extend any promotion while it is still active. While this may be the intended behavior, I wanted to point out that the creator of the promotion can run with the tokens from extendPromotion, by calling cancelPromotion while the promotion is still active.
Recommended Mitigation Steps
Mitigation could be that onlyPromotionCreator can extendPromotion, but again I am not sure maybe this risk is known and intended.
PierrickGT
commented
2 years ago
Handle
pauliax
Vulnerability details
Impact
The creator can cancel the extended promotion. Anyone can extend any promotion while it is still active. While this may be the intended behavior, I wanted to point out that the creator of the promotion can run with the tokens from extendPromotion, by calling cancelPromotion while the promotion is still active.
Recommended Mitigation Steps
Mitigation could be that onlyPromotionCreator can extendPromotion, but again I am not sure maybe this risk is known and intended.