Submission Details
Severity:
Some user could be blacklisted by ERC-20 tokens like USDC/USDT/WBTC which could DOS `_distribute`.
Summary
The pull over push method OR try-catch is not used in _distribute function which gives out tokens to winners.
Vulnerability Details
Lets check the for-loop from _distribute function.
uint256 winnersLength = winners.length; // cache length
for (uint256 i; i < winnersLength;) {
uint256 amount = totalAmount * percentages[i] / BASIS_POINTS;
erc20.safeTransfer(winners[i], amount);
unchecked {
++i;
}
}
The parent function distribute() is marked as external and will be called from another contract. In case the params passed to this function are dynamic (winners are selected by logic in contract), and if one of the address is blacklisted by the tokens like USDC/USDT/WBTC, etc, then the function breaks and nobody can receive rewards.
Impact
DOS
Tools Used
Manual
Recommendations
Use try-catch or prefer pull over push method.
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
19477 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.