Sparkn

CodeFox Inc.
DeFiFoundryProxy
15,000 USDC
View results
Previous Next
Submission Details
Severity: high

Lack of Token Balance Check on transfer of token amounts which can lead to can lead to an inconsistent distribution and token transfer will fail

0xVinylDavyl

Summary

In the _distribute function, the code transfers token amounts to winners based on their percentages. However, there is no validation to ensure that the contract has a sufficient balance of the token to cover the total amount being distributed.

Vulnerability Details

​
uint256 totalAmount = erc20.balanceOf(address(this));
// ...
for (uint256 i; i < winnersLength;) {
uint256 amount = totalAmount * percentages[i] / BASIS_POINTS;
erc20.safeTransfer(winners[i], amount);
unchecked {
++i;
}
}
​
​

Impact

If the contract's balance of the token is insufficient to cover the total amount being distributed, the token transfer will fail. This can lead to an inconsistent distribution process and disrupt the intended flow of the contract.

Tools Used

Manual

Recommendations

Before proceeding with the distribution loop, add a check to ensure that the contract's balance of the token is greater than or equal to the total amount to be distributed. This will prevent failed token transfers due to insufficient balance and ensure a reliable distribution process.

To ensure that the contract has sufficient balance of the token to cover the distribution, implement a balance check before proceeding with the token transfers.

uint256 totalAmount = erc20.balanceOf(address(this));
uint256 totalDistributionAmount = 0;
​
for (uint256 i; i < winnersLength; i++) {
totalDistributionAmount += totalAmount * percentages[i] / BASIS_POINTS;
}
​
require(totalDistributionAmount <= totalAmount, "Insufficient token balance for distribution");
​
for (uint256 i = 0; i < winnersLength; i++) {
uint256 amount = totalAmount * percentages[i] / BASIS_POINTS;
erc20.safeTransfer(winners[i], amount);
}
​

Explanation:

  1. Calculate the total amount that will be distributed (totalDistributionAmount) by summing up the amounts for each winner.

  2. Check if the totalDistributionAmount is less than or equal to the totalAmount of the token held by the contract.

  3. If the balance check passes, proceed with the token transfers as originally intended.
    Adding this balance check before distributing tokens ensures that the contract can cover the distribution and prevents failed transfers due to insufficient balances.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.