Incorrect End Index Calculation:
The line let end := add(recipients.offset, shl(5, recipients.length)) calculates the end index by shifting recipients.length left by 5 bits (shl(5, recipients.length)) and adding it to the recipients.offset.
The intended purpose seems to be calculating the memory offset of the last element in the recipients array.
Flaw in Shifting Operation:
The problem lies in the shifting operation (shl(5, recipients.length)).
While a single address occupies 32 bytes in memory, shifting recipients.length by 5 bits only multiplies it by 32 if recipients.length is guaranteed to be a multiple of 32.
If the recipients.length has a remainder when divided by 32 (i.e., the array has a size that isn't a perfect multiple of 32 elements), the shifting operation will not produce the correct offset for the last element.
Potential Consequences:
In cases where the recipients.length isn't a multiple of 32, the calculated end index will be incorrect. This could lead to the loop:
Iterating through fewer elements than intended (missing recipients).
Attempting to access memory outside the bounds of the recipients array (potential out-of-bounds error or unexpected behavior).
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.