Submission Details
Severity:
Tokens can get stuck forever if no one solves the problem i.e 0 winners
Vulnerability Details
If in a contest, no one participates to solve the problem of others , i.e the number of winners are zero , then their might be an issue.
function _distribute(address token, address[] memory winners, uint256[] memory percentages, bytes memory data)
internal
{
..
..
// winners and percentages input check
if (winners.length == 0 || winners.length != percentages.length) revert Distributor__MismatchedArrays();
..
..
}
If the number of winners is zero, the winner's array length will be zero.
Also, the Distributor has no method to rescue any stuck tokens.
Impact
Loss of funds in tokens to the protocol
Tools Used
Manual review
Recommendations
Include a withdraw method to pull tokens out of the contract if closeTime is met.
function rescueTokens(address token)onlyOwner{
erc20.safeTransfer(msg.sender, erc20.balanceOf(address(this)));
}
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
19477 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.