First Flight #20: The Predicter

Summary

The ThePredicter::withdraw function fails to handle scenarios where the maximum score (maxScore) is zero, leading to a division by zero error and preventing reward distribution.

Vulnerability Details

In the withdraw function, the case where score is 0 or negative value, and maxScore is 0. This scenario bypasses the initial revert check if (maxScore > 0 && score <= 0). Then the reward calculation then uses a ternary operator:

With maxScore being 0, it chooses the second option, leading to:

However, totalShares will also be 0, causing a division by zero error and the function to revert.

Impact

This vulnerability prevents any rewards from being distributed when all players have non-positive scores. It effectively locks the funds in the contract under these circumstances, as the withdraw function will always revert.

Tools Used

Manual review

Recommendations