Big Flaxen Dove - Malicious actor can reparticipate in FCFS

[sherlock-admin3]

Big Flaxen Dove

High

Malicious actor can reparticipate in FCFS

Summary

Malicious actor can reparticipate in FCFS.

Root cause

https://github.com/sherlock-audit/2025-02-rova/blob/fe68ceb7d90693f9be5c7fb94dde130da8d60d9e/rova-contracts/src/Launch.sol#L246

        if (userTokenAmount > 0) {
            if (!settings.finalizesAtParticipation) {
                revert MaxUserParticipationsReached(request.launchGroupId, request.userId);
            }
        }

PoC

if (!settings.finalizesAtParticipation) {revert ..}

works incorrectly to allow user participate again in FCFS Launch Groups.

Mitigation

Consider to change validation to:

if (settings.finalizesAtParticipation) {revert ..}