Submission Details
Severity:
Incorrect get active player index
Summary
If active player not find, always return position for first player.
Vulnerability Details
If after call getActivePlayerIndex(address player) player not find, return 0. 0 - index of the first player who participates in the lottery. So if no active player is found, the index of the first player will always be returned.
Impact
Incorrect definition of an active lottery player.
Tools Used
Manual review
Recommendations
Replace return 0 with return -1.
Updates
Lead Judging Commences
Hamiltonite almost 2 years ago
Submission Judgement Published Assigned finding tags:
getActivePlayerIndex can say a player is both entered at slot 0 and inactive
Rewards breakdown
nSLOC
143This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.