MyCut
First Flight #23
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

No mechanism to prevent multi-call overfunding the contest

cryptolappi

Summary

The fundContest function in the ContestManager contract is vulnerable to multi-call issues. It lacks safeguards against multiple funding attempts for the same contest, which could lead to overfunding, inconsistent state, and potential fund loss.

Vulnerability Details

The fundContest function allows the contract owner to fund a contest:

function fundContest(uint256 index) public onlyOwner {
Pot pot = Pot(contests[index]);
IERC20 token = pot.getToken();
uint256 totalRewards = contestToTotalRewards[address(pot)];
​
if (token.balanceOf(msg.sender) < totalRewards) {
revert ContestManager__InsufficientFunds();
}
​
token.transferFrom(msg.sender, address(pot), totalRewards);
}

Key vulnerabilities:

  1. No check to prevent multiple funding calls for the same contest.

  2. Lack of state tracking to indicate if a contest has been funded.

Impact

  1. Financial Risk: Potential overfunding of contests, locking excess tokens in the Pot contract.

  2. Inconsistent State: The contract state may not accurately reflect the actual funding status of contests.

  3. Reduced Transparency: Lack of events makes it difficult to track funding actions off-chain.

  4. Operational Issues: Difficulty in managing and tracking the funding status of multiple contests.

Tools Used

Manual code review.

AI for report.

Recommendations

Implement a funding flag or track funded amounts:

mapping(address => bool) public contestFunded;
​
function fundContest(uint256 index) public onlyOwner {
Pot pot = Pot(contests[index]);
require(!contestFunded[address(pot)], "Contest already funded");
// ... existing code ...
contestFunded[address(pot)] = true;
}
Updates

Lead Judging Commences

equious Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Known issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.