Submission Details
Severity:
Hash collision in pools
Summary
because the pool id is stored as a hash, there is potential for another user to have the same hash for their pool id
Vulnerability Details
mapping(bytes32 => Pool) public pools;
The protocol hashes pool IDs with keccack256, multiple inputs can have the same hash even if they are different. For example if another users provided input where to be the same as an existing users poolId hash, the previous users poolID information will get overwritten by the new users. This will cause problems and users may lose their entire funds that are in the protocol.
Impact
Users can lose all funds in protocol
Tools Used
manual review
Recommendations
N/A
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
70628 USDC / LOC
18,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.