Merge pull request #2 from GenerationSoftware/audit-issue-2

exclude second that verification ends at
GenerationSoftware · Oct 21, 2024 · db4ad38 · db4ad38
2 parents 025e5e9 + c3a1e94
commit db4ad38
Show file tree

Hide file tree

Showing 3 changed files with 4 additions and 4 deletions.
diff --git a/src/WorldIdVerifiedPrizeVault.sol b/src/WorldIdVerifiedPrizeVault.sol
@@ -116,7 +116,7 @@ contract WorldIdVerifiedPrizeVault is Ownable, ERC4626, Claimable {
     /// @inheritdoc ERC4626
     /// @dev limited by the per-account limiter and world ID verification
     function maxDeposit(address _receiver) public view override returns (uint256) {
-        if (worldIdAddressBook.addressVerifiedUntil(_receiver) < block.timestamp) {
+        if (worldIdAddressBook.addressVerifiedUntil(_receiver) <= block.timestamp) {
             return 0;
         } else {
             uint256 _receiverBalance = balanceOf(_receiver);

diff --git a/test/WorldIdVerifiedPrizeVault.t.sol b/test/WorldIdVerifiedPrizeVault.t.sol
@@ -357,7 +357,7 @@ contract WorldIdVerifiedPrizeVaultTest is Test {
         prizeToken.approve(address(worldVault), 100e18);
         worldVault.deposit(1e18, alice);
 
-        vm.warp(worldIdAddressBook.addressVerifiedUntil(alice) + 1);
+        vm.warp(worldIdAddressBook.addressVerifiedUntil(alice));
 
         // alice cannot make new deposits or mints
         vm.expectRevert(
@@ -381,7 +381,7 @@ contract WorldIdVerifiedPrizeVaultTest is Test {
 
         // others cannot transfer shares to alice
         vm.startPrank(bob);
-        worldIdAddressBook.setAccountVerification(block.timestamp);
+        worldIdAddressBook.setAccountVerification(block.timestamp + 1);
         prizeToken.mint(bob, 100e18);
         prizeToken.approve(address(worldVault), 100e18);
         worldVault.deposit(1e18, bob);

diff --git a/test/WorldIdVerifiedPrizeVaultInvariant.t.sol b/test/WorldIdVerifiedPrizeVaultInvariant.t.sol
@@ -44,7 +44,7 @@ contract PrizeVaultInvariant is Test {
     function invariantCantDepositMoreThanMax() external useCurrentTime {
         address alice = vaultHarness.alice();
         WorldIdVerifiedPrizeVaultWrapper worldVault = vaultHarness.worldVault();
-        if (vaultHarness.worldIdAddressBook().addressVerifiedUntil(alice) >= block.timestamp) {
+        if (vaultHarness.worldIdAddressBook().addressVerifiedUntil(alice) > block.timestamp) {
             uint256 balance = worldVault.balanceOf(alice);
             uint256 maxDepositLimit = worldVault.accountDepositLimit();
             if (balance >= maxDepositLimit) {