Sparkn

CodeFox Inc.
DeFiFoundryProxy
15,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Locked rewards in distributing rewards to winners

oualidpro

Summary

Locked rewards in distributing rewards to winners

Vulnerability Details

When distributing rewards for winners, the function erc20.safeTransfer(winners[i], amount); is called inside a loop and there is no protection against a revert. therefore, as there is no check for the addresses used by winners, if a winner address is blacklisted then the safeTransfer() function will revert each time that function is called. This leads to Blocking legitimate winners from receiving their funds.

File: src/Distributor.sol
​
function _distribute(address token, address[] memory winners, uint256[] memory percentages, bytes memory data)
internal
{
// token address input check
if (token == address(0)) revert Distributor__NoZeroAddress();
if (!_isWhiteListed(token)) {
revert Distributor__InvalidTokenAddress();
}
// winners and percentages input check
if (winners.length == 0 || winners.length != percentages.length) revert Distributor__MismatchedArrays();
uint256 percentagesLength = percentages.length;
uint256 totalPercentage;
for (uint256 i; i < percentagesLength;) {
totalPercentage += percentages[i];
unchecked {
++i;
}
}
// check if totalPercentage is correct
if (totalPercentage != (10000 - COMMISSION_FEE)) {
revert Distributor__MismatchedPercentages();
}
IERC20 erc20 = IERC20(token);
uint256 totalAmount = erc20.balanceOf(address(this));
​
// if there is no token to distribute, then revert
if (totalAmount == 0) revert Distributor__NoTokenToDistribute();
​
uint256 winnersLength = winners.length; // cache length
for (uint256 i; i < winnersLength;) {
uint256 amount = totalAmount * percentages[i] / BASIS_POINTS;
erc20.safeTransfer(winners[i], amount);
unchecked {
++i;
}
}
​
// send commission fee as well as all the remaining tokens to STADIUM_ADDRESS to avoid dust remaining
_commissionTransfer(erc20);
emit Distributed(token, winners, percentages, data);
}
​

Impact

Locked rewards

Tools Used

Manual

Recommendations

Check the winner's addresses before calling the distribution function for any possible address(0x0) address.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.