F-2025-0007·unnecessary-restriction

Unnecessary cycle timing restriction on redemptions leads to unfair user experience

Fixedlotterypixel-lotterychainlink-vrf
TL;DR

redeemPixels() carries the onlyDuringCycle modifier, blocking winners from claiming during the 1-hour pre-draw window even though redemptions only operate on historical data from completed draws.

Severity
LOW
Impact
LOW
Likelihood
MEDIUM
Method
MManual review
CAT.
Complexity
LOW
Exploitability
LOW
02Section · Description

Description

The redeemPixels() function incorrectly applies the onlyDuringCycle modifier, which prevents users from redeeming their winning pixels during the 1-hour downtime period before each draw. This restriction serves no technical security purpose since redemptions operate entirely on historical data from previous completed draws, not current cycle state.

The onlyDuringCycle modifier is designed to prevent new pixel purchases during the final hour before a draw to maintain cycle integrity. However, applying this same restriction to redemptions creates artificial barriers for legitimate winners.

The redemption process validates pixel ownership against previousDrawTime and utilizes finalized results from completed draws, ensuring it is entirely independent of current cycle timing.

Unfair user experience where legitimate winners are artificially prevented from claiming rewards, creating opportunities for economic manipulation where informed users redeem early while uninformed users face lockout periods.

03Section · Recommendation

Recommendation

Remove Unnecessary Modifier: Remove the onlyDuringCycle modifier from the redeemPixels() function:

solidity
function redeemPixels(uint32[] calldata _pixels) external nonReentrant {
// Remove onlyDuringCycle modifier - redemptions use historical data only
uint32 length = uint32(_pixels.length);
// ... rest of function remains unchanged
}
04Section · Resolution

Resolution

Golden Grid: Confirmed.

Zealynx: Fixed. Asked for clarification on the solution implemented since it differed from the proposed one, and agreed to the reasoning for it.

Status
Fixed
F-2025-0007

oog
zealynx

Smart Contract Security Digest

Monthly exploit breakdowns, audit checklists, and DeFi security research — straight to your inbox

© 2026 Zealynx