{"action":"created","issue":{"url":"https://api.github.com/repos/OpenZeppelin/openzeppelin-solidity/issues/443","repository_url":"https://api.github.com/repos/OpenZeppelin/openzeppelin-solidity","labels_url":"https://api.github.com/repos/OpenZeppelin/openzeppelin-solidity/issues/443/labels{/name}","comments_url":"https://api.github.com/repos/OpenZeppelin/openzeppelin-solidity/issues/443/comments","events_url":"https://api.github.com/repos/OpenZeppelin/openzeppelin-solidity/issues/443/events","html_url":"https://github.com/OpenZeppelin/openzeppelin-solidity/issues/443","id":257506604,"node_id":"MDU6SXNzdWUyNTc1MDY2MDQ=","number":443,"title":"Crowdsale contract vulnerable to \"fund recycling\" attack","user":{"login":"vadimkerr","id":20116910,"node_id":"MDQ6VXNlcjIwMTE2OTEw","avatar_url":"https://avatars3.githubusercontent.com/u/20116910?v=4","gravatar_id":"","url":"https://api.github.com/users/vadimkerr","html_url":"https://github.com/vadimkerr","followers_url":"https://api.github.com/users/vadimkerr/followers","following_url":"https://api.github.com/users/vadimkerr/following{/other_user}","gists_url":"https://api.github.com/users/vadimkerr/gists{/gist_id}","starred_url":"https://api.github.com/users/vadimkerr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vadimkerr/subscriptions","organizations_url":"https://api.github.com/users/vadimkerr/orgs","repos_url":"https://api.github.com/users/vadimkerr/repos","events_url":"https://api.github.com/users/vadimkerr/events{/privacy}","received_events_url":"https://api.github.com/users/vadimkerr/received_events","type":"User","site_admin":false},"labels":[{"id":417782817,"node_id":"MDU6TGFiZWw0MTc3ODI4MTc=","url":"https://api.github.com/repos/OpenZeppelin/openzeppelin-solidity/labels/bug","name":"bug","color":"b60205","default":true}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":9,"created_at":"2017-09-13T20:12:53Z","updated_at":"2019-04-08T22:55:53Z","closed_at":"2019-04-08T22:55:53Z","author_association":"NONE","body":"https://github.com/OpenZeppelin/zeppelin-solidity/blob/master/contracts/crowdsale/Crowdsale.sol#L88\r\nThis comment should warn user that in default implementation forwardFund function can cause situation when owner can cheat the system by recycling ether trough the contract."},"comment":{"url":"https://api.github.com/repos/OpenZeppelin/openzeppelin-solidity/issues/comments/481037443","html_url":"https://github.com/OpenZeppelin/openzeppelin-solidity/issues/443#issuecomment-481037443","issue_url":"https://api.github.com/repos/OpenZeppelin/openzeppelin-solidity/issues/443","id":481037443,"node_id":"MDEyOklzc3VlQ29tbWVudDQ4MTAzNzQ0Mw==","user":{"login":"nventuro","id":2530770,"node_id":"MDQ6VXNlcjI1MzA3NzA=","avatar_url":"https://avatars1.githubusercontent.com/u/2530770?v=4","gravatar_id":"","url":"https://api.github.com/users/nventuro","html_url":"https://github.com/nventuro","followers_url":"https://api.github.com/users/nventuro/followers","following_url":"https://api.github.com/users/nventuro/following{/other_user}","gists_url":"https://api.github.com/users/nventuro/gists{/gist_id}","starred_url":"https://api.github.com/users/nventuro/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nventuro/subscriptions","organizations_url":"https://api.github.com/users/nventuro/orgs","repos_url":"https://api.github.com/users/nventuro/repos","events_url":"https://api.github.com/users/nventuro/events{/privacy}","received_events_url":"https://api.github.com/users/nventuro/received_events","type":"User","site_admin":false},"created_at":"2019-04-08T22:55:53Z","updated_at":"2019-04-08T22:55:53Z","author_association":"CONTRIBUTOR","body":"After giving this some more thought, I now believe this is out of scope of the baseline `Crowdsale` contract (on which there's no concept of the crowdsale 'ending' due to a goal being reached, the funding window being closed, etc.). Such a feature can be implemented by passing an `Escrow` as the crowdsale wallet, but we cannot force this without fundamentally changing how the current model works.\r\n\r\nGiven that the tools exist to properly and safely develop this, I'm closing the issue and marking as won't fix. A dishonest fund raise will not be impeded by OpenZeppelin holding honest code."}}
{"actor":{"display_login":"nventuro"}}