Submitted by Dravee, also found by hansfriese
contracts/ERC721Vestable.sol#L99-L101
contracts/ERC721Vestable.sol#L44
contracts/ERC721Vestable.sol#L65
Past similar finding with the same severity: https://github.com/code-423n4/2022-05-runes-findings/issues/30
While centralization risk is acknowledged by the team & the C4udit tool: this may lead to loss of functionality (grief).
There is no requirement for the start time to be before the end time:
Changing the start time in such a way (by error) can break the logic of transfer during the vesting period:
While less severe, it can also break the following view function:
I believe that vestingStart and vestingEnd should be immutable/constants. But in case the sponsor still wants them to be editable: consider adding the following check:
The process to edit the vesting period would then be to first edit vestingEnd if the new vestingStart is going to be bigger that it.
Alex the Entreprenerd (judge) commented:
msclecram (Forgotten Runiverse) confirmed
Alex the Entreprenerd (judge) commented:
msclecram (Forgotten Runiverse) commented:
For this audit, 4 reports were submitted by wardens detailing low risk and non-critical issues. The report highlighted below by Lambda received the top score from the judge.
The following wardens also submitted reports: Dravee, hansfriese, and cccz.
