Submission Details
Severity:
Potential Denial Of Service in withdraw Function
Summary
The withdraw function iterates through the entire list of players to calculate the maximum score and total positive points. This iteration can lead to high gas consumption, potentially making the function non-executable if the gas limit is exceeded, particularly as the number of players approaches the maximum (30 players).
Vulnerability Details
POC
// SPDX-License-Identifier: MIT
import "forge-std/Test.sol";
import "../src/ThePredicter.sol";
import "../src/ScoreBoard.sol";
contract ThePredicterTest is Test {
ThePredicter thePredicter;
ScoreBoard scoreBoard;
address organizer = address(1);
address[] players;
function setUp() public {
scoreBoard = new ScoreBoard();
thePredicter = new ThePredicter(address(scoreBoard), 0.1 ether, 0.01 ether);
// Deal some ether to the organizer and players
vm.deal(organizer, 1 ether);
for (uint256 i = 0; i < 30; i++) {
address player = address(uint160(i + 2)); // Start from address 2 onwards
players.push(player);
vm.deal(player, 1 ether);
vm.startPrank(player);
thePredicter.register{value: 0.1 ether}();
vm.stopPrank();
}
// Approve players
vm.startPrank(organizer);
for (uint256 i = 0; i < 30; i++) {
thePredicter.approvePlayer(players[i]);
}
vm.stopPrank();
}
function testWithdrawGasConsumption() public {
for (uint256 i = 0; i < 30; i++) {
vm.startPrank(players[i]);
thePredicter.makePrediction{value: 0.01 ether}(0, ScoreBoard.Result.Win);
vm.stopPrank();
}
vm.startPrank(players[0]);
uint256 gasStart = gasleft();
thePredicter.withdraw();
uint256 gasUsed = gasStart - gasleft();
console.log("Gas used:", gasUsed);
vm.stopPrank();
}
}
Impact
Medium. While the player limit is set to 30, the potential for high gas consumption still poses a risk.
Tools Used
Manual Review and Foundry
Recommendations
Consider optimizing the function to avoid iterating over all players
Rewards breakdown
nSLOC
191This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.