Sparkn

CodeFox Inc.
DeFiFoundryProxy
15,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Winner's Array may contain duplicated addresses

torpedopistolixc41

Summary

Winner's Array may contain duplicated addresses

Vulnerability Details

Winners array seems not checked if theres duplication inside the array inside.So the rewards being send as percentage so there would be mistakenly send more rewards to duplicated address..

Impact

Loss of funds caused by user/organizer/owner error .According to protocol developer's these are trusted individuals yet they'r not error prone to begin with .

POC for this bug

function createDataWithDuplicatedWinner()public view returns (bytes memory data){
address[] memory tokens_ = new address[](1);
tokens_[0] = jpycv2Address;
address[] memory winners = new address[](2);
winners[0]=(user1);
winners[1]=(user1);
uint256[] memory percentages_ = new uint256[](2);
percentages_[0]=(5000);
percentages_[1]=(4500);
data = abi.encodeWithSelector(Distributor.distribute.selector, jpycv2Address, winners, percentages_, "");
}
​
function testSucceedsEvenIfTheWinnerIsDuplicated() public setUpContestForJasonAndSentJpycv2Token(organizer) {
// before
assertEq(MockERC20(jpycv2Address).balanceOf(user1), 0 ether);
assertEq(MockERC20(jpycv2Address).balanceOf(stadiumAddress), 0 ether);
​
bytes32 randomId_ = keccak256(abi.encode("Jason", "001"));
bytes memory data = createDataWithDuplicatedWinner();
​
vm.warp(16 days);
vm.startPrank(factoryAdmin);
proxyFactory.deployProxyAndDistributeByOwner(organizer, randomId_, address(distributor), data);
vm.stopPrank();
​
// after
assertEq(MockERC20(jpycv2Address).balanceOf(user1), 9500 ether);
assertEq(MockERC20(jpycv2Address).balanceOf(stadiumAddress), 500 ether);
}
​

Tools Used

Foundry test suite-Manual overview

Recommendations

This code block may used if there's duplication exist and take appropriate action according to protocol developer's intentions

function checkDuplicates(uint[] memory arr) public pure returns(bool) {
uint i;
bool[] memory tmp;
for(;i<arr.length;) {
if(tmp[arr[i]] == true) {
return false;
}
tmp[arr[i]] = true;
​
unchecked {
i++;
}
}
return true;
}

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.