No checks for ongoing dispute before some Ciritical Actions #171
Labels
bug
Something isn't working
QA (Quality Assurance)
Assets are not at risk. State handling, function incorrect as to spec, issues with clarity, syntax
sponsor disputed
Sponsor cannot duplicate the issue, or otherwise disagrees this is an issue
valid
Lines of code
https://github.com/code-423n4/2022-08-rigor/blob/main/contracts/Project.sol#L330
https://github.com/code-423n4/2022-08-rigor/blob/main/contracts/Project.sol#L386
https://github.com/code-423n4/2022-08-rigor/blob/main/contracts/Project.sol#L219
Vulnerability details
Impact
There are 3 instances where a check for ongoing dispute should have been done at the start of the functions, however there were no such checks.
Using setComplete as an example, it was documented in contest page
.... If there is no ongoing dispute about that project, task status is updated and payment is made....
, looking at the code, when a TaskPay actionType dispute has been raised for a Task on the project, setComplete() can still be called successfully.Above is similar to the orderChange() and addTask() functions.
Tools Used
Manual review
Recommended Mitigation Steps
A check for dispute present should be done at the start of the function calls for addTask, orderChange and setComplete functions.
The text was updated successfully, but these errors were encountered: