Sparkn

CodeFox Inc.
DeFiFoundryProxy
15,000 USDC
View results
Submission Details
Severity: low
Valid

_distribute function will not revert for low sponsor funded amount and resuls in distributing 0 balance to winners.

Vulnerability Details

Suppose that there was very tiny funding received of only 1, then the function will not be reverted and will still lead to distribution of winnings of 0 amount.
Suppose one winner got 50% winning reward, let's do the calculation

uint256 amount = totalAmount * percentages[i] / BASIS_POINTS;
amount = 1 * 5000 / 10000 = 0 and lead to sending of 0 balance to winner, which should not be the case.

Tools Used

Manual Testing

Recommendations

  • To have a check on the totalAmount that there should be some minimum amount then only we can distribute.

  • Or we can modify the way we receive the fundings from sponsor, so instead of deploying the proxy contract after the contest is over, we should deploy it at the starting of contest and define a function to manage the fundings received to only allow user to fund for some minimum amount.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!