Submission Details
Severity:
integer Overflow on Amount Calculation `Distributor.sol`
Summary
An integer overflow could occur when calculating winner payout amounts.
Vulnerability
The amount calculation uses:
uint amount = totalAmount * percentages[i] / BASIS_POINTS;
This could overflow if totalAmount * percentages[i] exceeds type(uint256).max.
For example, with totalAmount = 50 ether and percentages[i] = 20000.
Impact
Incorrect winner payout amounts. Could lead to loss of funds.
Tools Used
Manual
Recommendations
Use SafeMath to prevent overflows:
using SafeMath for uint;
uint amount = totalAmount.mul(percentages[i]).div(BASIS_POINTS);
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
19477 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.