Whitelisting Manual Review Findings

WGN-01M: Non-Standard Whitelist Condition

Type	Severity	Location
Standard Conformity		Whitelisting.sol:L64

Description:

The Whitelisting::isWhitelisted condition will evaluate whether the whitelistExpiration of an account is strictly greater-than the current block.timestamp, implying that an expiration exactly equal to the block.timestamp would infer the whitelist has expired.

While this is an acceptable design choice, most whitelist systems revoke the whitelist status beyond the timestamp at which the expiration is meant to take place.

Example:

Copy
60/// @notice Check if an address is currently whitelisted
61/// @param account Address to check
62/// @return true if whitelisted and not expired
63function isWhitelisted(address account) external view returns (bool) {
64    return whitelistExpiration[account] > block.timestamp;
65}

Recommendation:

We advise the conditional to be made inclusive, ensuring expirations at the current block.timestamp can be utilized in a compose-able manner (i.e. an operator being whitelisted for the current transaction only by setting their whitelist state to block.timestamp).

Alleviation (fdf0694b5c38834fa5a20cb2765766924d34f5d4):

The condition was updated to be inclusive per our recommendation, addressing this exhibit.