Submission Details
Severity:
No function to update the root
Summary
There is no function to update the root but an event for that is created
Vulnerability Details
As the root can't be updated a Merkle validation can only be performed for the initial four addresses.
Probably the contract owners intend to add more addresses in the future, if not they wouldn't have used Merkle tree for four addresses, and the event
event MerkleRootUpdated(bytes32 newMerkleRoot); is created which, but a function was forgotten to be added.
Impact
Only the initial four addresses can claim the reward.
Tools Used
Manual review
Recommendations
Add an option for the owner to update the root.
Updates
Lead Judging Commences
inallhonesty about 1 year ago
Submission Judgement Published Reason: Non-acceptable severity
Assigned finding tags:
Info
Rewards breakdown
nSLOC
62This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.