Submission Details
Severity:
Input Validation Error: player vs. reward length
Summary
When a new pot is created in ContestManager::createContest, the length of players and rewards can mismatch due to a missing array length check.
Vulnerability Details
When a pot is created in createContest, it can (accidentally) happen that the array length of players and rewards mismatch. Those arrays are expected to match but are not validated before use.
Impact
This can lead to out-of-bound errors, incorrect reward distribution or skipping/ignoring the rewards for players
Tools Used
Manual Review
Recommendations
Adding an array length validation, such as
function createContest(address[] memory players, uint256[] memory rewards, IERC20 token, uint256 totalRewards)
public
onlyOwner
returns (address)
{
// Create a new Pot contract
+ require(players.length==rewards.length, "Players and rewards length mismatch");
Pot pot = new Pot(players, rewards, token, totalRewards);
contests.push(address(pot));
contestToTotalRewards[address(pot)] = totalRewards;
return address(pot);
}
Rewards breakdown
nSLOC
106This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.