volodya - Users able to deposit at epoch time they are not suppose to

[sherlock-admin]

volodya

medium

Users able to deposit at epoch time they are not suppose to

Summary

if block.timestamp == epochConfig[_id].epochBegin then both modifiers will not revert which is probably not correct. There is variable _epochEnd in the contract that is not being used and seems like it is supposed to be in those modifiers.

    modifier epochHasNotStarted(uint256 _id) {
        if (block.timestamp > epochConfig[_id].epochBegin)
            revert EpochAlreadyStarted();
        _;
    }

    /** @notice You can only call functions that use this modifier after the epoch has started
     */
    modifier epochHasStarted(uint256 _id) {
        if (block.timestamp < epochConfig[_id].epochBegin)
            revert EpochNotStarted();
        _;
    }

VaultV2.sol#L432

Vulnerability Detail

Impact

Users are able to deposit at epoch times they are not supposed to

Code Snippet

Tool used

Manual Review

Recommendation

    /** @notice You can only call functions that use this modifier before the epoch has started
     */
    modifier epochHasNotStarted(uint256 _id) {
        if (block.timestamp >= epochConfig[_id].epochBegin && block.timestamp <= epochConfig[_id].epochEnd)
            revert EpochAlreadyStarted();
        _;
    }

    /** @notice You can only call functions that use this modifier after the epoch has started
     */
    modifier epochHasStarted(uint256 _id) {
        if (block.timestamp < epochConfig[_id].epochBegin  && block.timestamp > epochConfig[_id].epochEnd)
            revert EpochNotStarted();
        _;
    }

Duplicate of #480