sechub
HomeServicesAssetsJobsFindingsTicketsGovCheck
Guest Mode. Click here to sign in and access all features

    No input sanitization for endBlock and startBlock

    Holoride: DeFi Token

    Severity
    Low
    Status
    Fixed
    Location(s)

    https://github.com/sub7security/holoride-defi/blob/main/contracts/Farming.sol#L64-L73

    Description

    erc20, rewardPerBlock, endBlock and startBlock are set in the constructor and can’t be modified later. The arguments passed are not checked if they are valid and non-zero. Also, contract can be funded only when block.number < endBlock. So, if startBlock is set to block.number, then contract won't be funded and will be useless. Also, it needs to be ensured that startBlock is not too much in the future otherwise contract will be open for funding but reward distribution will start too long in the future.

    Recommendation

    Add basic sanitization for input value considering above cases.

    Comments
    No comments yet

    No input sanitization for endBlock and startBlock

    Holoride: DeFi Token

    Severity
    Low
    Status
    Fixed