Submission Details
Severity:
Wrong calculation of prizePool and fee
Summary
Wrong calculation of prizePool and fee
Vulnerability Details
The initial assumption that 'uint256 totalAmountCollected = players.length * entranceFee;' is wrong. It does not take into consideration the fact that there could be address(0) values in the 'players' array.
From that point on all further calculations are wrong.
Impact
The whole economics of the contract is based on wrong assumptions.
Tools Used
Manual review
Recommendations
I am out of ideas! The whole contract is a mess!!!
Updates
Lead Judging Commences
Hamiltonite almost 2 years ago
Submission Judgement Published Assigned finding tags:
refund-doesnt-reduce-players-array-size-causing-protocol-to-freeze
zero address can win the raffle
Funds are locked to no one. If someone gets the refund issue, they also got this issue. IMPACT: High Likelihood: High
Rewards breakdown
nSLOC
143This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.