Submitted by hansfriese, also found by cccz
Project.sol#L330
setComplete() function might be called successfully using the past signature when it shouldnt work.
As a result, a task might be completed when a builder doesnt want it.
approveHash() function can set only true so there is no method to cancel already approved hash without passing validation here.
So the below scenario would be possible.
I dont know if there would be similar problems with other functions that use signature and I think it would reduce the risk a little if we add an option to cancel the approved hash.
Solidity Visual Developer of VSCode
Recommend modifying approveHash() like below.
I am not so sure that a similar scenario would be possible in the Community contract also and recommend to change both functions together.
parv3213 (Rigor) confirmed
