Submission Details
Severity:
The entrance Fee gets stuck if all the player have Zero points
Summary
There is an missing edge case in the withdraw() code where if all the players have 0 points then the function reverts on each call.
Vulnerability Details
If each player have 0 scores then totalShares is 0. Which will lead to divide by 0 revert error.
reward = maxScore < 0
? entranceFee
: (shares * players.length * entranceFee) / totalShares;
Impact
The entrance fee will be stuck in the contract.
POC
function test_WithdrawRevertIfTotalSharesIsZero() public {
address stranger2 = makeAddr("stranger2");
address stranger3 = makeAddr("stranger3");
vm.startPrank(stranger);
vm.deal(stranger, 1 ether);
thePredicter.register{value: 0.04 ether}();
vm.stopPrank();
vm.startPrank(stranger2);
vm.deal(stranger2, 1 ether);
thePredicter.register{value: 0.04 ether}();
vm.stopPrank();
vm.startPrank(stranger3);
vm.deal(stranger3, 1 ether);
thePredicter.register{value: 0.04 ether}();
vm.stopPrank();
vm.startPrank(organizer);
thePredicter.approvePlayer(stranger);
thePredicter.approvePlayer(stranger2);
thePredicter.approvePlayer(stranger3);
vm.stopPrank();
vm.startPrank(stranger);
thePredicter.makePrediction{value: 0.0001 ether}(
1,
ScoreBoard.Result.First
);
thePredicter.makePrediction{value: 0.0001 ether}(
2,
ScoreBoard.Result.First
);
thePredicter.makePrediction{value: 0.0001 ether}(
3,
ScoreBoard.Result.Draw
);
thePredicter.makePrediction{value: 0.0001 ether}(
4,
ScoreBoard.Result.Draw
);
thePredicter.makePrediction{value: 0.0001 ether}(
5,
ScoreBoard.Result.Draw
);
thePredicter.makePrediction{value: 0.0001 ether}(
6,
ScoreBoard.Result.Draw
);
vm.stopPrank();
vm.startPrank(organizer);
scoreBoard.setResult(0, ScoreBoard.Result.First);
scoreBoard.setResult(1, ScoreBoard.Result.First);
scoreBoard.setResult(2, ScoreBoard.Result.First);
scoreBoard.setResult(3, ScoreBoard.Result.First);
scoreBoard.setResult(4, ScoreBoard.Result.First);
scoreBoard.setResult(5, ScoreBoard.Result.First);
scoreBoard.setResult(6, ScoreBoard.Result.First);
scoreBoard.setResult(7, ScoreBoard.Result.First);
scoreBoard.setResult(8, ScoreBoard.Result.First);
vm.stopPrank();
vm.startPrank(organizer);
thePredicter.withdrawPredictionFees();
vm.stopPrank();
vm.expectRevert();
vm.startPrank(stranger);
thePredicter.withdraw();
}
Tools Used
VS Code
Recommendations
Change it as below.
reward = maxScore <= 0
? entranceFee
: (shares * players.length * entranceFee) / totalShares;
Updates
Lead Judging Commences
NightHawK about 1 year ago
Submission Judgement Published Assigned finding tags:
Possible maxScore of zero is not accounted
The checks related to maxScore do not account possible maxScore of zero leading to stuck funds or a division by zero error.
Rewards breakdown
nSLOC
191This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.