hats-finance / Proof-Of-Humanity-V2-0xef0709445d394a22704850c772a28a863bb780b0

Proof of Humanity Protocol v2
2 stars 1 forks source link

`challengeRequest` alows for claim request with the Reason of none #76

Open hats-bug-reporter[bot] opened 3 weeks ago

hats-bug-reporter[bot] commented 3 weeks ago

Github username: -- Twitter username: -- Submission hash (on-chain): 0xf7916a0eaa2cea275e9556d063ef5ecdf628c96866499d406671f75d4e679d79 Severity: low

Description: Description\ challengeRequest alows for claim request with the Reason of non as the comments says

If it's a revocation request, reason must be None. If it's a claim request, reason must not be None.'

and its not allowing the reason to be other than none for revocation request but contract fails to prevent users from calling it with none reason if its claim request

 require(request.revocation == (_reason == Reason.None));

Recommendation\ the fix should be done by adding this check to prevent users from providing none reason for claim requests

+  require(request.claim == (_reason != Reason.None));
 require(request.revocation == (_reason == Reason.None));
clesaege commented 3 weeks ago

Variables have default values, for booleans, it's False. So for a claim or renewal request request.revocation will be false. Therefore, for the require to pass, we will need (_reason == Reason.None) to also be false. Therefore we will need _reason != Reason.None.

The check works both to check that revocation requests have no reasons and that requests which are not revocation requests have a reason.