MyCut
First Flight #23
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Insufficient Balance Check in ContestManager.sol()::fundContest

sidhack3r11

Summary

https://github.com/Cyfrin/2024-08-MyCut/blob/main/src/ContestManager.sol

Vulnerability Details

The fundContest function checks if the sender has a sufficient balance but does not verify if the transferFrom operation is successful. This oversight can lead to a scenario where the function proceeds without ensuring the transfer actually occurred, potentially resulting in the contest not being funded as intended.

if (token.balanceOf(msg.sender) < totalRewards) {revert ContestManager__InsufficientFunds();}

Impact

If the sender does not have sufficient allowance set for the ContestManager contract, the transferFrom will fail, but the current code does not handle this failure explicitly. This can lead to failed transactions and incorrect funding of contests, causing potential loss of funds and operational issues.

Tools Used

Manual Review

Recommendations

Modify the fundContest function to verify that the transferFrom operation succeeds

require(token.transferFrom(msg.sender, address(pot), totalRewards), "Transfer failed");
​
Updates

Lead Judging Commences

equious Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.