PlasmaFinance Manual Review Findings

PFE-01M: Improper Configuration Sanitization

Description:

The PlasmaFinance contract improperly sanitizes the configurational values that are meant to be assigned to the BaseVesting contract implementation.

Example:

Copy
16require(token_ != address(0), "Invalid reward token address");
17require(startDate_ != 0, "TGE timestamp can't be 0");
18require(
19    vestingDuration_ > 0,
20    "The vesting duration cannot be 0"
21);
22require(
23    totalAllocatedAmount_ != 0,
24    "The number of tokens for distribution cannot be 0"
25);

Recommendation:

We advise additional checks to be imposed, such as the startDate_ to be a timestamp in the future, the amount unlocked between startDate and vestingTimeEnd to be below the total percentage and other similar logic checks.

Alleviation:

The configurational values of BaseVesting are now assigned by the contract's constructor instead of being done so on the contract level. Additionally, the BaseVesting implementation applies the necessary sanitization checks in their respective constructor functions thus alleviating this exhibit.