Submission Details
Severity:
NFTs and ETH Can Be Bruned
Summary
NFTs and ETH can be burned if player calls refund
Vulnerability Details
When a player calls refund the address at their index in the players array is set to address(0). If the winner index happens to be address(0) the winning funds and NFT will be burned and lost forever
Impact
Loss of NFTs and ETH
Tools Used
Manual Review
Recommendations
When deleting something from an array it is best to shift the index you want to delete to the end of the array and use .pop to remove it.
Updates
Lead Judging Commences
Hamiltonite over 1 year ago
Submission Judgement Published Assigned finding tags:
zero address can win the raffle
Funds are locked to no one. If someone gets the refund issue, they also got this issue. IMPACT: High Likelihood: High
Rewards breakdown
nSLOC
143This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.