Sparkn

CodeFox Inc.
DeFiFoundryProxy
15,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Blacklisted will be make `distribute` revert

tripathi

Summary

During distribution of reward organizer need to transfer reward to participant proportional to their contribution in the contest. A malicious participant can give blacklisted address for corresponding reward token making whole distribute function to revert.

Vulnerability Details

See Summary

File: src/Distributor.sol
​
for (uint256 i; i < winnersLength;) {
uint256 amount = totalAmount * percentages[i] / BASIS_POINTS;
erc20.safeTransfer(winners[i], amount);
unchecked {
++i;
}
}

for blacklisted winner above transfer will revert.

Impact

This will cause distribute to revert and organizer will have to pay extra gas fees to recheck that winner aren't blacklisted for corresponding token and then execute again.

Tools Used

Manual

Recommendations

Make sure that winner's given address are not blacklisted before executing distribute or shift to withdraw pattern than transferring tokens to winners

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!