MyCut

Summary

The ContestManager smart contract lacks proper input validation in the createContest function, specifically regarding the lengths of the players and rewards arrays. Without validation, this can lead to mismatches between players and their corresponding rewards, causing incorrect contest setups and potentially resulting in incorrect payouts, user disputes, or contract malfunctions.

Vulnerability Details

The createContest function accepts two arrays as input: players (a list of contest participants) and rewards (the corresponding rewards for each participant).

The function lacks a validation check to ensure that the players and rewards arrays are of the same length before proceeding with the creation of a contest

Impact

If the arrays are mismatched, the contest may be set up incorrectly, leading to players not receiving the rewards they are entitled to or rewards being misallocated.

Tools Used

Manual Review

Recommendation

Implement a validation check to ensure that the players and rewards arrays are of equal length before proceeding. If the lengths do not match, revert the transaction with a clear error message.