Submission Details
Severity:
`refund` can be called right before `selectWinner`
Summary
refund function can be called right before selectWinner
Vulnerability Details
A player can watch the mempool for the selectWinner function call, frontrun the tx and call refund to get back the entry fee and reduce the reward for the winner.
Impact
Owner gets less fee and winner gets less reward.
Tools Used
Manual
Recommendations
Don't allow players to call refund function once the raffle round has ended.
Updates
Lead Judging Commences
Hamiltonite almost 2 years ago
Submission Judgement Published Assigned finding tags:
selectWinner can be frontran
Rewards breakdown
nSLOC
143This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.