Submission Details
Severity:
Poor ETH Handling in `Dussehra::killRavana`, lead to DoS.
Description
When Ram call killRavana function, an amount totalAmountGivenToRam of ETH will be send to organiser address. If the organiser adddress is an EoA, the txn will go through. But If the organiser address is an contract with no fallback() or receive() function, killRavana will revert.
Impact
The killRavana function will always revert. No one can take money out.
Tools Used
Manual review.
Recommendations
Use Pull over Push pattern, the organiser have to call organiserWithdraw to withdraw money and use mapping to keep track of reward amount.
- uint256 public totalAmountGivenToRam;
+ mapping(address organiserOrRam => uint256 amount) public amountToWithdraw;
function killRavana() public RamIsSelected {
.
.
.
- totalAmountGivenToRam = (totalAmountByThePeople * 50) / 100;
+ uint256 reward = (totalAmountByThePeople * 50) / 100;
+ amountToWithdraw[organiser] = reward;
+ amountToWithdraw[choosingRamContract.selectedRam()] = reward;
- (bool success,) = organiser.call{value: totalAmountGivenToRam}("");
- require(success, "Failed to send money to organiser");
}
- function withdraw() public RamIsSelected OnlyRam RavanKilled {
- if (totalAmountGivenToRam == 0) {
- revert Dussehra__AlreadyClaimedAmount();
- }
- uint256 amount = totalAmountGivenToRam;
- (bool success,) = msg.sender.call{value: amount}("");
- require(success, "Failed to send money to Ram");
- totalAmountGivenToRam = 0;
- }
+ function organiserWithdraw() public RamIsSelected RavanKilled {
+ if (msg.sender != organiser) {
+ revert();
+ }
+ if (amountToWithdraw[organiser] == 0) {
+ revert();
+ }
+ uint256 amount = amountToWithdraw[organiser];
+ amountToWithdraw[organiser] = 0;
+ (bool success,) = msg.sender.call{value: amount}("");
+ require(success, "Failed to send money to organiser");
+ }
+ function ramWithdraw() public RamIsSelected OnlyRam RavanKilled {
+ address ram = choosingRamContract.selectedRam();
+ if (amountToWithdraw[ram] == 0) {
+ revert();
+ }
+ uint256 amount = amountToWithdraw[ram];
+ amountToWithdraw[ram] = 0;
+ (bool success,) = msg.sender.call{value: amount}("");
+ require(success, "Failed to send money to Ram");
+ }
Rewards breakdown
nSLOC
218This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.