Submission Details
Severity:
Unchecked external call - `Distributor.sol`
Summary
An attacker could front-run a legitimate distribute() call.
Vulnerability
distribute() does not check that the caller is authorized. An attacker could watch for a valid call and then submit their own first.
For example, they could create a contract:
contract Attacker {
function drain(Distributor d) external {
d.distribute{value: 0}(...);
}
}
And front-run the legit call and drain the funds.
Impact
Attacker could steal the full prize pool.
Tools Used
Manual
Recommendations
Use a commit-reveal scheme or require an authorized address:
address public authorized;
modifier onlyAuthorized() {
require(msg.sender == authorized, "Not authorized");
_;
}
function distribute() external onlyAuthorized {
//...
}
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
19477 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.