MyCut
First Flight #23
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

'Pot:Constructor' initialization will fail if the players array is larger than the rewards array

fels21

Summary

In the 'Pot:Constructor', the initialization will fail if the players array is larger than the rewards array.

Vulnerability Details

There is no check to ensure that the arrays are the same length or that the rewards array is at least as long as the players array. Since the initialization loop assumes both arrays are the same length, this will cause a failure:

for (uint256 i = 0; i < i_players.length; i++) {
playersToRewards[i_players[i]] = i_rewards[i];
}

Proof of code

function testPlayersRewardsDistinctLength() public mintAndApproveTokens {
address player3 = makeAddr("player3");
players.push(player3);
​
vm.startPrank(user);
vm.expectRevert();
contest = ContestManager(conMan).createContest(
players,
rewards,
IERC20(ERC20Mock(weth)),
4
);
}

Impact

In some cases, the admin will not be able to create a contest due to an "out of bounds" error, which can cause a loss of gas. The likelihood of this error is high, but the impact is relatively low since no actual funds are lost in the transaction except for the gas fees. Therefore, the total impact is considered Medium.

Tools Used

Manual code analysis.

Recommendations

One possible solution is to check the array lengths before proceeding and revert the transaction if the arrays do not match:

```diff
constructor(
address[] memory players,
uint256[] memory rewards,
IERC20 token,
uint256 totalRewards
) {
+require(players.length == rewards.length, "Players and rewards length mismatch");
​
i_players = players;
i_rewards = rewards;
i_token = token;
i_totalRewards = totalRewards;
remainingRewards = totalRewards;
i_deployedAt = block.timestamp;
​
for (uint256 i = 0; i < i_players.length; i++) {
playersToRewards[i_players[i]] = i_rewards[i];
}
}
```
Updates

Lead Judging Commences

equious Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Known issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.