Submission Details
Severity:
There is no way to determine winners[] and percentages[] have same order.
Summary
The length of winners[] and percentages[] is checked but there is no to determine if their order is same.
Vulnerability Details
If the order of winners[] and percentages[] is not same, winning funds can be mismatched.
Impact
The winners may lose their winnings and receive very low amounts than what they are supposed to.
Tools Used
Manual Analysis
Recommendations
Instead of using two separate arrays, use a single array of struct.
Example:
struct WinnerDetails {
address Winner;
uint96 percentage; // struct packing to save gas
}
And use this in the _distribute() function:
WinnerDetails[] calldata winners;
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
19477 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.