Submission Details
Severity:
User can get infinite rewards (HealthToken).
Summary
User can get infinite HealthTokens by calling the updateCountMartenitsaTokensOwner function, as it has no access control.
Vulnerability Details
The updateCountMartenitsaTokensOwner function can be called multiple times adding countMartenitsaTokensOwner to himself, because there is no access control.
Than by calling collectReward the malicious user can get HealthTokens for every 3 requiredMartenitsaTokens.
Impact
High because a user can get infinite HealthTokens.
Tools Used
Manual review
Recommendations
Add access control to updateCountMartenitsaTokensOwner function.
Rewards breakdown
nSLOC
239This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.