KeyringCoreV2Base::registerKey() could check that validTo is equal to or bigger than block.timestamp

Low/InfoKeyring Credentials audit·Three Sigma·Zero-knowledge compliance·10th July, 20243S-Keyring-N04

Description

KeyringCoreV2Base::registerKey() registers a key with a validity between validFrom and validTo. It checks if validTo <= validFrom, but does not confirm that validTo is not set in the past.

Recommendation

solidity

if (validTo < block.timestamp) {
    revert ErrInvalidKeyRegistration("IVT");
}

Status

Addressed in #ffe8b11.

Source

Disclosed by 0xSimao · Sherlock's 2025 Watson of the Year · 21 first places in 57 audit contests