Submission Details
Severity:
[L-4] Low-level calls is observed in the `ThePredicter::cancelRegistration`, `ThePredicter::withdrawPredictionFees` and `ThePredicter::withdraw`
Summary: The low-level call vulnerability can be found at numerous palces in the code. The low-level calls are error-prone as they do not check for code existence or call success.
Vulnerability Details :Low-level calls can be observed in ThePredicter::cancelRegistration, ThePredicter::withdrawPredictionFees and ThePredicter::withdraw functions. There is no check for code existense and if the call fails, the operation is still carried out. The vulnerability can be found in the below code.
function withdrawPredictionFees() public {
if (msg.sender != organizer) {
revert ThePredicter__NotEligibleForWithdraw();
}
uint256 fees = address(this).balance - players.length * entranceFee;
(bool success, ) = msg.sender.call{value: fees}("");
require(success, "Failed to withdraw");
}
Impact: Low-level call usage has a high chance of erroring out and does not check for call success or code existence. In low-level calls when faults are encountered, these return the Boolean value false and carry on with the operation.
Tools Used
Recommendations: The check is added such that the balance of the msg.sender and fees is more than zero to handle the low-level call. The lock modifier is added to prevent further attacks from low-level calls.
bool private _locked;
modifier lock() {
if (_locked) {
revert ThePredicter__NotAllowedToReEnter();
}
_locked = true;
_;
_locked = false;
}
function withdrawPredictionFees() public {
if (msg.sender != organizer) {
revert ThePredicter__NotEligibleForWithdraw();
}
uint256 fees = address(this).balance - _length * entranceFee;
if ((msg.sender).balance>0 && fees>0){
balances[msg.sender] = 0;
(bool success, ) = msg.sender.call{value: fees}("");
require(success, "Failed to withdraw");
}
}
Rewards breakdown
nSLOC
191This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.