Sparkn

CodeFox Inc.
DeFiFoundryProxy
15,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Fund distribution may run out of gas

draiakoo

Summary

The way to distribute the funds for the winners is made with a for loop, if the array of winners is too long, it may run out of gas and revert.
https://github.com/Cyfrin/2023-08-sparkn/blob/main/src/Distributor.sol#L145-L151

Vulnerability Details

If the are too much winners in a contest, the loop of fund distribution may run out of gas. If it is the case, the contract will not be able to distribute the tokens.

#####POC

function testTooMuchWinners() public {
vm.selectFork(mainnetFork);
assertEq(vm.activeFork(), mainnetFork);
​
bytes32 contestId = 0x0000000000000000000000000000000000000000000000000000000000000001;
​
// Create a contest
vm.startPrank(owner);
proxyFactory.setContest(organizer, contestId, block.timestamp + 10 days, goodImplementation);
​
// Sponsor funds the event with 1000 usdc
deal(usdc, sponsor, 1000 * 10 ** 6);
assertEq(ERC20(usdc).balanceOf(sponsor), 1000 * 10 ** 6);
address proxyAddress = proxyFactory.getProxyAddress(_calculateSalt(organizer, contestId, goodImplementation), goodImplementation);
vm.prank(sponsor);
ERC20(usdc).transfer(proxyAddress, 1000 * 10 ** 6);
​
// Contest ends
skip(11 days);
​
// Distribute funds
uint256 winnerAmount = 1000;
​
address[] memory winners = new address[](winnerAmount);
uint256[] memory percentages = new uint256[](winnerAmount);
uint256 accumulatedPercentage;
for(uint256 i = 1;i <= winnerAmount - 1; i++){
address winner = address(uint160(i));
winners[i-1] = winner;
percentages[i-1] = 10;
accumulatedPercentage+=10;
}
winners[winnerAmount - 1] = makeAddr("lastwinner");
percentages[winnerAmount - 1] = 9500 - accumulatedPercentage;
​
​
bytes memory distributeData = abi.encodeWithSignature("distribute(address,address[],uint256[],bytes)", usdc, winners, percentages, "");
vm.startPrank(organizer);
proxyFactory.deployProxyAndDistribute(contestId, implementation, distributeData);
}

Impact

Medium

Tools Used

Manual review

Recommendations

Set a maxium number of winners, or if the array is too long, divide the distribution in packs of a certain amount of winners and distribute the funds in more than a single call.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!