Skip to content

DoS Overpowered Owner

Pre-release
Pre-release
Compare
Choose a tag to compare
@fabianorodrigo fabianorodrigo released this 09 May 19:27

MAJOR CHANGES

In order to improve decentralization and at the same time mitigate the security flaw known as 'DoS overpowered owner', where the project and assets can be lost if the owner's key is compromised or if something happen to the owner so as he can't make the privileged operations, was implemented a Timelock solution to the operations of closing the Games for bettings and to finalize the Game.

Close: only the owner can close a game for bettings until the block timestamp has passed 15 minutes from the time foreseen to start the game. From this moment, any account can close a game for bettings.

Finalize: only the onwer can finalize the game and input the final score until the block timestamp has passed 48 hours from the time foreseen to start the game. From this moment, any account can finalize a game and set the final score.

PS: The operations of identifying winners and prizes calculations is already open for anyone.

MINOR CHANGES

  • Renaming of modifier onlyDelegateCall to onlyProxy so as the Slither`s unprotected-upgradeable-contract detector does not report a FP. More details here: crytic/slither#1136
  • Automated tests refactoring: make use of Waffle Fixtures, directory reorganization
  • Automated tests: Testing scenarios where the implementation contracts are called directly in spite of via proxy contract
  • FRONTEND: validation of the connected chain based on the value returned by the RPC 'eth_chainId' against the value configured in the Angular environment.ts