During emergency withdraw() if the token is ERC20 then it doesn't check block.timestamp with `startClaimDate`

[howlbot-integration[bot]]

Lines of code

https://github.com/code-423n4/2024-05-loop/blob/main/src/PrelaunchPoints.sol#L291 https://github.com/code-423n4/2024-05-loop/blob/main/src/PrelaunchPoints.sol#L301-L302

Vulnerability details

Impact

• During emergency withdraw() if the token is ERC20 then it doesn't check block.timestamp with startClaimDate
• If the token is ETH there is a check that block.timestamp > startClaimDate() https://github.com/code-423n4/2024-05-loop/blob/main/src/PrelaunchPoints.sol#L291 but if the token is ERC20 then there is no check that block.timestamp > startClaimDate().

Proof of Concept

• https://github.com/code-423n4/2024-05-loop/blob/main/src/PrelaunchPoints.sol#L291
• https://github.com/code-423n4/2024-05-loop/blob/main/src/PrelaunchPoints.sol#L301-L302

Tools Used

Manual review

Recommended Mitigation Steps

• Apply a check for ERC20 token as well for withdraw()

Assessed type

Other

[c4-judge]

koolexcrypto marked the issue as duplicate of #17

[c4-judge]

koolexcrypto marked the issue as unsatisfactory: Invalid