Sandclock contest - p4st13r4's results

Handle

p4st13r4

Vulnerability details

Impact

There are a couple unsolved TODOs in the code, which could hint at open issues or missing implementation

Proof of Concept

• https://github.com/code-423n4/2022-01-sandclock/blob/main/sandclock/contracts/Vault.sol#L291
• https://github.com/code-423n4/2022-01-sandclock/blob/main/sandclock/contracts/Vault.sol#L637
• https://github.com/code-423n4/2022-01-sandclock/blob/main/sandclock/contracts/vault/Claimers.sol#L32
• https://github.com/code-423n4/2022-01-sandclock/blob/main/sandclock/contracts/vault/Depositors.sol#L43

Tools Used

Editor

Recommended Mitigation Steps

Fix the issues and remove the TODOs

Handle

p4st13r4

Vulnerability details

Impact

The revert string for the onlyVault modifier in Depositors.sol contains a message that refers to another contract, which can be misleading

Proof of Concept

https://github.com/code-423n4/2022-01-sandclock/blob/main/sandclock/contracts/vault/Depositors.sol#L30

Tools Used

Editor

Recommended Mitigation Steps

Change to

modifier onlyVault() {
    require(msg.sender == vault, "Depositors: not authorized");
    _;
}