First Flight #13: Baba Marta
First Flight #13
Beginner FriendlyFoundryGameFi
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Lack of proper reward calculation in `MartenitsaMarketplace::collectReward` function can lead to denying rewards for user that transfers tokens and acquires new tokens.

mirkopezo

Summary

Reward calculation is faulty in MartenitsaMarketplace::collectReward function because it is not considering that user can transfer tokens and acquire new ones.

Vulnerability Details

Natspec function comment says: "The user can get for every 3 different MartenitsaTokens 1 HealthToken". Which means user should be able to claim 1 health token for every 3 different Martenitsa tokens.

  1. User has 3 Martenitsa token, and is eligible for reward.

  2. User collects reward by calling MartenitsaMarketplace::collectReward function.

  3. User transfer those 3 tokens to another address.

  4. User acquires 3 completely different tokens (different token id).

  5. User is not eligible for rewards when calling MartenitsaMarketplace::collectReward function.

/**
* @notice Function to collect HealthToken. The user can get for every 3 different MartenitsaTokens 1 HealthToken.
* @notice Producers are not able to call this function.
*/
function collectReward() external {
require(!martenitsaToken.isProducer(msg.sender), "You are producer and not eligible for a reward!");
uint256 count = martenitsaToken.getCountMartenitsaTokensOwner(msg.sender);
@> uint256 amountRewards = (count / requiredMartenitsaTokens) - _collectedRewards[msg.sender];
if (amountRewards > 0) {
_collectedRewards[msg.sender] = amountRewards;
healthToken.distributeHealthToken(msg.sender, amountRewards);
}
}

Impact

User can be denied rewards that it has rights to because of faulty logic.

Tools Used

Manual review

Recommendations

Make reward collection logic so that is not dependent of how many tokens user has, but of how many token ids it has that were not claimed yet.

Updates

Lead Judging Commences

bube Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Incorrect logic in collectReward

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.