Submission Details
Severity:
Potential DOS due to external calls in loop
Summary
The withdraw function in ThePredicter contract makes external calls inside a loop, which could lead to a denial-of-service attack.
Vulnerability Details
In the withdraw function:
for (uint256 i = 0; i < players.length; ++i) {
int8 cScore = scoreBoard.getPlayerScore(players[i]);
// ...
}
The function calls an external contract (scoreBoard.getPlayerScore) for each player in the loop.
Impact
As the number of players increases, the gas cost of this function will increase too. This could lead to the function hitting the block gas limit, locking funds in the contract.
Tools Used
Manual code review
Recommendations
Modify the ScoreBoard contract.
Rewards breakdown
nSLOC
191This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.