Closed code423n4 closed 2 years ago
Not a bug.
This is desired functionality apparently. I have to admit I agree with the warden's suggestion, but also with the sponsor that this does not represent a bug. No funds are at risk and I'm not even sure this require would be worth the gas.
Handle
WatchPug
Vulnerability details
https://github.com/code-423n4/2022-01-sandclock/blob/a90ad3824955327597be00bb0bd183a9c228a4fb/sandclock/contracts/Vault.sol#L425-L430
Given that
_lockedUntil
is not upper-bounded, if the user passes an excessively large value mistakenly, their funds can be locked for an unreasonably period of time.Considering the severity of the impact, we suggest adding a
maxLockPeriod
.Recommendation