Submission Details
Severity:
Unchecked Transfer
Summary
no check on transfer success
Vulnerability Details
in ContestManager.sol , line 37
function fundContest(uint256 index) public onlyOwner {
Pot pot = Pot(contests[index]);
IERC20 token = pot.getToken();
uint256 totalRewards = contestToTotalRewards[address(pot)];
if (token.balanceOf(msg.sender) < totalRewards) {
revert ContestManager__InsufficientFunds();
}
// @audit no check on success of the transfer, usage of safeERC20 library recommended
token.transferFrom(msg.sender, address(pot), totalRewards);
}
Impact
contest can be considered funded without actually transferring the required tokens.
Tools Used
slither
Recommendations
usage of SafeERC20
Rewards breakdown
nSLOC
106This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.