fix VULN-334

contracts/LiquidityBridgeContract.sol

@@ -719,6 +719,7 @@ contract LiquidityBridgeContract is Initializable, OwnableUpgradeable {
     ) external payable {
         require(isRegisteredForPegout(quote.lpRskAddress), "LBC037");
         require(quote.value + quote.callFee <= msg.value, "LBC063");
+        require(block.timestamp <= quote.depositDateLimit, "LBC065");
         require(block.timestamp <= quote.expireDate, "LBC046");
         require(block.number <= quote.expireBlock, "LBC047");
 
@@ -994,13 +995,6 @@ contract LiquidityBridgeContract is Initializable, OwnableUpgradeable {
 
         uint256 firstConfirmationTimestamp = getBtcBlockTimestamp(firstConfirmationHeader);
 
-        // do not penalize if deposit was not made on time
-        uint timeLimit = quote.agreementTimestamp + quote.depositDateLimit;
-        uint depositTimestamp = pegoutRegistry[quoteHash].depositTimestamp;
-        if (depositTimestamp > timeLimit) {
-            return false;
-        }
-
         // penalize if the transfer was not made on time
         if (firstConfirmationTimestamp > pegoutRegistry[quoteHash].depositTimestamp + quote.transferTime + btcBlockTime) {
             return true;

readme.MD

@@ -75,6 +75,7 @@ Note that the call performed by the LP can be a transfer of value to an account
 - <b>LBC062</b>: slicing out of range
 - <b>LBC063</b>: Not enough value
 - <b>LBC064</b>: Pegout finalized
+- <b>LBC065</b>: Deposit date limit expired
 
 ## Quote
 

test/basic.tests.js

@@ -1134,6 +1134,20 @@ contract("LiquidityBridgeContract", async (accounts) => {
     await truffleAssertions.reverts(revertByTime, "LBC046");
   });
 
+  it("Should not allow to deposit pegout after deposit date limit", async () => {
+    const quote = utils.getTestPegOutQuote(
+      instance.address, //lbc address
+      liquidityProviderRskAddress,
+      accounts[2],
+      1000
+    );
+
+    quote.depositDateLimit = quote.agreementTimestamp;
+    const tx = instance.depositPegout(quote, { value: 2000 });
+
+    await truffleAssertions.reverts(tx, "LBC065");
+  });
+
   it("Should not allow to deposit the same quote twice", async () => {
     const quote = utils.getTestPegOutQuote(
       instance.address, //lbc address

test/penalization.tests.js

@@ -263,57 +263,6 @@ contract('LiquidityBridgeContract', async accounts => {
         expect(lpBal).to.eql(web3.utils.toBN(reward).add(peginAmount));
     });
 
-
-  it("Should not penalize LP on pegout when deposit was not made on time", async () => {
-    await instance.addPegoutCollateral({
-      value: web3.utils.toWei("30000", "wei"),
-      from: liquidityProviderRskAddress,
-    });
-    const btcTxHash =
-      "0xa0cad11b688340cfbb8515d4deb7d37a8c67ea70a938578295f28b6cd8b5aade";
-    const blockHeaderHash =
-      "0x02327049330a25d4d17e53e79f478cbb79c53a509679b1d8a1505c5697afb326";
-    const partialMerkleTree =
-      "0x02327049330a25d4d17e53e79f478cbb79c53a509679b1d8a1505c5697afb426";
-    const merkleBranchHashes = [
-      "0x02327049330a25d4d17e53e79f478cbb79c53a509679b1d8a1505c5697afb326",
-    ];
-
-    let quote = utils.getTestPegOutQuote(
-      instance.address, //lbc address
-      liquidityProviderRskAddress,
-      accounts[2],
-      web3.utils.toBN(25)
-    );
-    quote.transferConfirmations = 0;
-    quote.depositDateLimit = 0;
-    quote.agreementTimestamp = Math.round(new Date().getTime() / 1000) - 1
-
-    // configure mocked block on mockBridge
-    const firstConfirmationTime = utils.reverseHexBytes(
-      web3.utils.toHex(quote.agreementTimestamp + 300).substring(2)
-    );
-    const firstHeader =
-      "0x0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" +
-      firstConfirmationTime +
-      "0000000000000000";
-    await bridgeMockInstance.setHeaderByHash(blockHeaderHash, firstHeader);
-
-    const msgValue = quote.value.add(quote.callFee);
-    const pegOut = await instance.depositPegout(quote, { value: msgValue.toNumber() });
-    truffleAssert.eventEmitted(pegOut, "PegOutDeposit");
-
-    const refund = await instance.refundPegOut(
-      quote,
-      btcTxHash,
-      blockHeaderHash,
-      partialMerkleTree,
-      merkleBranchHashes
-    );
-    truffleAssert.eventEmitted(refund, "PegOutRefunded");
-    truffleAssert.eventNotEmitted(refund, "Penalized");
-  });
-
   it("Should penalize LP on pegout if the transfer was not made on time", async () => {
     await instance.addPegoutCollateral({
       value: web3.utils.toWei("30000", "wei"),

test/utils/index.js

@@ -53,7 +53,7 @@ function getTestPegOutQuote(lbcAddress, lpRskAddress, rskRefundAddress, value) {
   let expireDate = Math.round(new Date().getTime() / 1000) + 3600;
   let expireBlock = 4000;
   let transferTime = 1661788988;
-  let depositDateLimit = 600;
+  let depositDateLimit = Math.round(new Date().getTime() / 1000) + 600;
   let depositConfirmations = 10;
   let transferConfirmations = 10;
   let penaltyFee = web3.utils.toBN(0);