MyCut
First Flight #23
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Checking for Array Mismatch Between Rewards Array and Players Array

frontrunner

Vulnerability Details

The vulnerability occurs within the createContest function in the Manager contract and the constructor of the Pot contract. The createContest function is responsible for deploying the Pot contract, passing arrays of players and rewards, along with other parameters, to the Pot constructor.

// ContestManager contract
function createContest(address[] memory players, uint256[] memory rewards, IERC20 token, uint256 totalRewards)
public
onlyOwner
returns (address)
{
// Create a new Pot contract
Pot pot = new Pot(players, rewards, token, totalRewards);
contests.push(address(pot));
contestToTotalRewards[address(pot)] = totalRewards;
return address(pot);
}
​
//Pot Contract
constructor(address[] memory players, uint256[] memory rewards, IERC20 token, uint256 totalRewards) {
i_players = players;
i_rewards = rewards;
i_token = token;
i_totalRewards = totalRewards;
remainingRewards = totalRewards;
i_deployedAt = block.timestamp;
​
for (uint256 i = 0; i < i_players.length; i++) { // @audit ++++> no check for array mismatch
@> playersToRewards[i_players[i]] = i_rewards[i];
}
}
​

The Pot contract constructor does not validate whether the length of the players array matches the length of the rewards array. If the players array is longer than the rewards array, this will result in an arrayOutOfBound error when the constructor tries to access an index in the rewards array that does not exist. This error will prevent the Pot contract from being deployed, potentially halting the operation of the system.

Impact

Contract Deployment Failure: The mismatch between the arrays can cause the deployment of the Pot contract to fail, leading to an inability to create new contests.

Tools Used

Foundry

Recommendations

The code below fixes the issue and rightly checks if there's an array mismatch between rewards and players array. If there is a mismatch it reverts and informs the deployer why the deployment didn't go through.

constructor(address[] memory players, uint256[] memory rewards, IERC20 token, uint256 totalRewards) {
+ require(players.length == rewards.length, "Players and rewards arrays must be of equal length");
​
i_players = players;
i_rewards = rewards;
i_token = token;
i_totalRewards = totalRewards;
remainingRewards = totalRewards;
i_deployedAt = block.timestamp;
​
for (uint256 i = 0; i < i_players.length; i++) {
playersToRewards[i_players[i]] = i_rewards[i];
}
}
​
Updates

Lead Judging Commences

equious Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Known issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.