# Lack of check on mustStartAtOrAfter

Juicebox JBFundingCycleStore lacked a bounds check on mustStartAtOrAfter, letting a huge value overflow the packed start field and bypass ballot waiting time.

- Payout: Contest reward
- Severity: medium
- Program: Juicebox
- Credited: zzzitron
- Disclosed: 2022-10-11
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-07-juicebox-findings/issues/220
- Library page: https://bugbountylibrary.com/r/c4%3A2022-07-juicebox%3AM-02
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** JBFundingCycleStore funding cycle configuration (Solidity contract)
**Root cause:** configureFor does not validate _mustStartAtOrAfter against uint56; the value is shifted left 144 bits in _packAndStoreIntrinsicPropertiesOf, overflowing into the start field and carrying into the number field.
**Steps:**
1. Call configureFor with a funding cycle where only mustStartAtOrAfter is set to `type(uint56).max` while a ballot is configured.
2. In _packAndStoreIntrinsicPropertiesOf, `packed |= _start << 144` overflows so the stored start becomes an arbitrary/past value.
3. Observe the new funding cycle becomes current immediately instead of waiting for the ballot delay (3 days in the base test).
**How found:** Modified the existing TestReconfigure::testReconfigureProject test, changing only mustStartAtOrAfter to type(uint56).max, and observed the new cycle became current without the ballot wait; traced to the shift-packing in _packAndStoreIntrinsicPropertiesOf.
**Exploitation:** Project owner submits a reconfigure with mustStartAtOrAfter = type(uint56).max; the packed start overflows to a past timestamp, so the new cycle takes effect immediately, bypassing the ballot's waiting period.
**Insight:** When a value is bit-packed via left-shift into a fixed-width slot, test boundary values like type(uintN).max to see if the shift overflows into adjacent fields (here also carrying into the cycle number).