Submission Details
Severity:
Bad logic implementation in `collectRewards()`
Summary
Bad logic implementation in collectRewards() allowing the callers to collect unlimited rewards through multiple calls of the function
Vulnerability Details
the _collectedRewards[msg.sender] should add amountRewards, not be set to amountRewards.
Impact
_collectedRewards[msg.sender] might never be 0.
Tools Used
Manual analysis
Recommendations
function collectReward() external {
require(!martenitsaToken.isProducer(msg.sender), "You are producer and not eligible for a reward!");
uint256 count = martenitsaToken.getCountMartenitsaTokensOwner(msg.sender);
uint256 amountRewards = (count / requiredMartenitsaTokens) - _collectedRewards[msg.sender];
if (amountRewards > 0) {
+ _collectedRewards[msg.sender] += amountRewards;
- _collectedRewards[msg.sender] = amountRewards;
healthToken.distributeHealthToken(msg.sender, amountRewards);
}
}
Updates
Lead Judging Commences
bube over 1 year ago
Submission Judgement Published Assigned finding tags:
_collectedRewards is not updated correctly
Rewards breakdown
nSLOC
239This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.