# All functions could have a `started` modifier as they should not be called before the start time Low/Info · Three Sigma · DeFi game · 23rd October, 2024 Finding I-3 of the CODEUP security review. - Report: /reports/codeup - Source: https://cdn.sanity.io/files/qoqld077/staging/d9e57830a75b5165fd56e8b88037de7986a165ec.pdf --- ### Description Only `Codeup::addGameETH()` checks if the protocol has started in `require(block.timestamp > startUNIX, NotStarted());`, but the same checks could be applied to the remaining functions. Although this presents no vulnerability as these functions will not do anything before adding `gameETH`, it is a good practice to prevent unwanted behaviours. ### Recommendation Create a modifier having `require(block.timestamp > startUNIX, NotStarted());` and place it in all functions. --- Related findings: - [`DrawManager.canStartDraw` does not consider retried RNG requests when determining if a new draw auction can be started](https://0xsimao.com/findings/pooltogether-the-prize-layer-for-defi-retried-rng-determining-started): PoolTogether Prize Layer - [Functions can be marked external when only called from other contracts](https://0xsimao.com/findings/keyring-ii-marked-external-called-contracts): Keyring Credentials - [Consider using a time lock on critical permissioned functions.](https://0xsimao.com/findings/maple-finance-iii-consider-lock-critical-permissioned): Maple Finance