Submitted by 0x1f8b
Shelter.sol#L38-L42
Shelter contract can steal user tokens.
Shelter client can call activate on an already activated token, this will reset its start time, so if the client activate a token when it GRACE_PERIOD is almost finished, it will reset this time.
This will prevent the user to call withdraw because the condition activated[_token] + GRACE_PERIOD < block.timestamp but will allow the client to call deactivate and receive all funds from the users because it will satisfy the condition activated[_token] + GRACE_PERIOD > block.timestamp.
Steps:
leekt (Concur) disputed
Alex the Entreprenerd (judge) decreased severity to Medium and commented:
