Submission Details
Severity:
In `function setContest`, `salt` should be emitted instead of `contestId` to achieve more uniqueness on a contest identity
Summary
Contract doesn't guarantee contestId to be unique and this parameter is emitted on-chain. This is not supposed on-chain.
Since contestId is used to derive bytes32 salt, then salt which is significantly a more unique parameter and the final derivative should instead be the emitted parameter for identifying a contest uniquely.
Vulnerability Details
Impact
In case of a situation where investigation may be carried(on-chain) requiring tracing back to some contest, emmited contestId aren't guaranteed to be unique.
Tools Used
Manual review
Recommendations
salt should be emitted instead of contestId
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
19477 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.