Submission Details
Severity:
Double queuedNewLocks push on initialize function in SDLPoolSecondary
Summary
Double queuedNewLocks push on initialize function in SDLPoolSecondary
Vulnerability Details
As seen below there is a duplicate push op of queuedNewLocks on initialize function, seeing the previous updateBatchIndex and currentMintLockIdByBatch consider only one time insertion, I might assume this is a typo or overlooked code.
File: SDLPoolSecondary.sol
66: function initialize(
67: string memory _name,
68: string memory _symbol,
69: address _sdlToken,
70: address _boostController,
71: uint256 _queuedNewLockLimit
72: ) public initializer {
73: __SDLPoolBase_init(_name, _symbol, _sdlToken, _boostController);
74: updateBatchIndex = 1;
75: currentMintLockIdByBatch.push(0);
76: queuedNewLocks.push();
77: queuedNewLocks.push();
78: queuedNewLockLimit = _queuedNewLockLimit;
79: }
Impact
initially the queuedNewLocks contains two empty queue instead of one
Tools Used
Manual analysis
Recommendations
remove one queuedNewLocks.push();
Prize pool breakdown
Total prize
27,500 USDC
nSLOC
1,41419 USDC / LOC
25,000 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.