Submission Details
Severity:
Manipulate Percentages to Drain Funds `Distributor.sol`
Summary
An attacker can pass manipulated arrays to distribute() to allocate 100% of funds to themselves.
Vulnerability Details
The distribute() function does not validate that the % for each winner is below a maximum threshold. An attacker could craft the percentages array to give 100% to themselves.
For example:
distribute(
token,
[attacker],
[10000], // 100%
""
)
Impact
An attacker could drain all available funds.
Tools Used
Manual
Recommendations
Add a modifier to limit individual percentages:
modifier validPercentage(uint256[] memory percentages) {
for(uint i = 0; i < percentages.length; i++) {
require(percentages[i] < MAX_SHARE, "...")
}
_;
}
function distribute(
address token,
address[] memory winners,
uint256[] memory percentages,
bytes memory data
) external validPercentage(percentages) {
//...
}
Set MAX_SHARE to something like 5000 (50%).
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
19477 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.