Submission Details
Severity:
One Blacklisted Winner Halts All Payouts
Summary
If the contest is over and one winner is blacklisted by the token contract that is being used as a reward, the _distribute function will fail. This means all other winners will also be unable to receive their tokens.
Vulnerability Details
The _distribute function has a loop that reverts if it encounters a blacklisted winner, affecting all.
uint256 winnersLength = winners.length; // cache length
for (uint256 i; i < winnersLength;) {
uint256 amount = totalAmount * percentages[i] / BASIS_POINTS;
erc20.safeTransfer(winners[i], amount);
unchecked {
++i;
}
Impact
All the non blacklisted users can't receive their prize because of one single user. the funds get stuck.
Tools Used
Manual review
Recommendations
Check every user to see if any of them are blacklisted by the token being awarded.
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
19477 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.