Description

In the DomaRecordRegistrarFacet contract, the renew() function is called by registrars to renew a domain name. It requires the registrar to pass in a new expiresAt timestamp for the domain.

This function is missing a check to ensure that the expiresAt timestamp is not from the past.

Impact

Although the cross-chain call to ProxyDomaRecord::renew() will fail (as that function does validate the expiresAt timestamp), the name.expiresAt field is already updated in the DomaRecordRegistrarFacet::renew() function. This causes an inconsistent cross-chain state between the two contracts.

Since registrars are trusted entities, this issue could only occur by accident, which is why we set the final impact as Low.

Recommendations

Add validation logic for the expiresAt timestamp.

Remediation

This issue has been acknowledged by D3, and a fix was implemented in commit 65a5b48b↗.