MyCut
First Flight #23
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Launch Contest without Funding

kryptonomousB

Summary

ContestManager.sol allows you to create a contest createContest() without funding the contest.

Vulnerability Detail

Owner can create a new contest and is not required to fund the contest upon launch. Players can still call the claimcut() function causing an error because the funds are not available to transfer. Also, fundContest can be called multiple times and only checks if msg.senders token.balance > totalRewards as a requirement. It does not check if the contract is funded or not.

contestManager.sol
​
function fundContest(uint256 index) public onlyOwner {
Pot pot = Pot(contests[index]);
IERC20 token = pot.getToken();
uint256 totalRewards = contestToTotalRewards[address(pot)];
​
if (token.balanceOf(msg.sender) < totalRewards) {
revert ContestManager__InsufficientFunds();
}
​
token.transferFrom(msg.sender, address(pot), totalRewards);
}
pot.sol
​
function claimCut() public {
address player = msg.sender;
uint256 reward = playersToRewards[player];
if (reward <= 0) {
revert Pot__RewardNotFound();
}
playersToRewards[player] = 0;
remainingRewards -= reward;
claimants.push(player);
console.log("Players is claiming rewards", reward);
_transferReward(player, reward);
}



Impact

contest will not function correctly, lack of accounting, loss of funds.

Tools Used

forge

Recommendations

add a requirement/checking system to see if funds are available on the Contest contract. ie require(balance >= reward, "funds not available")
or require funds to be transfers in the createContest() upon creation.

Updates

Lead Judging Commences

equious Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Design choice

Appeal created

kryptonomousB Submitter
about 1 year ago
equious Lead Judge
about 1 year ago
equious Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.