getRemainingRewards() Malfunction for unstarted promotions

[code423n4]

Handle

WatchPug

Vulnerability details

For unstarted promotions, cancelPromotion() will revert at block.timestamp - _promotion.startTimestamp in _getCurrentEpochId().

Call stack: getRemainingRewards() -> _getRemainingRewards() -> _getCurrentEpochId().

https://github.com/pooltogether/v4-periphery/blob/0e94c54774a6fce29daf9cb23353208f80de63eb/contracts/TwabRewards.sol#L276-L279

function _getCurrentEpochId(Promotion memory _promotion) internal view returns (uint256) {
    // elapsedTimestamp / epochDurationTimestamp
    return (block.timestamp - _promotion.startTimestamp) / _promotion.epochDuration;
}

Recommendation

Change to:

function _getCurrentEpochId(Promotion memory _promotion) internal view returns (uint256) {
    // elapsedTimestamp / epochDurationTimestamp
    if (block.timestamp <= _promotion.startTimestamp) {
        return 0
    }
    return (block.timestamp - _promotion.startTimestamp) / _promotion.epochDuration;
}

[PierrickGT]

This issue has been fixed in the following issue.
Duplicate of #101