Submission Details
Severity:
Precision loss in score
Summary
The conversion from int8 score to uint256 shares in the withdraw function of ThePredicter.sol could lead to precision loss.
Vulnerability Details
The line uint256 shares = uint8(score); first converts int8 to uint8, then to uint256. Negative scores are lost in this conversion.
Impact
Players with negative scores see their score up to 0. As it is not a critical vuln since they can't withdraw, the scoreboard would not reflet the real score of the players.
Recommendations
Add a check to the reward calculation to handle negative scores correctly:
uint256 shares = score > 0 ? uint256(uint8(score)) : 0;
Rewards breakdown
nSLOC
191This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.