Submission Details
Severity:
`ContestManager::createContest` function doesn't verify totalRewards is the sum of all rewards.
Description:
totalRewards param should be equal to the sum of all rewards and there is not a check of that.
Impact:
If by error owner create a contest a totalRewards amount less than the sum of all reward some claimants won't be able to claim their cut.
Proof of Concept:
Paste next code in the TestMyCut.sol file
function testUserCantClaimCutDueToLackOfMatchingTotalRewardsCheck() mintAndApproveTokens public {
address player3 = makeAddr("player3");
vm.startPrank(user);
rewards = [20, 50, 100];
players = [player1, player2, player3];
totalRewards = 100;
contest = ContestManager(conMan).createContest(players, rewards, IERC20(ERC20Mock(weth)), totalRewards);
ContestManager(conMan).fundContest(0);
vm.stopPrank();
vm.startPrank(player1);
Pot(contest).claimCut();
vm.stopPrank();
vm.startPrank(player2);
Pot(contest).claimCut();
vm.stopPrank();
vm.startPrank(player3);
vm.expectRevert(); // Will revert due to panic: arithmetic underflow or overflow error
Pot(contest).claimCut();
vm.stopPrank();
}
Recommended Mitigation:
Add a conditional to check if totalRewards is equal to the sum of the rewards.
function createContest(address[] memory players, uint256[] memory rewards, IERC20 token, uint256 totalRewards)
public
onlyOwner
returns (address)
{
+ uint256 _totalRewards = 0;
+ for (uint256 i = 0; i < rewards.length; i++) {
+ _totalRewards += rewards[i];
+ }
+ if(_totalRewards != totalRewards){
+ revert ContestManager__WrongTotalRewards();
+ }
Pot pot = new Pot(players, rewards, token, totalRewards);
contests.push(address(pot));
contestToTotalRewards[address(pot)] = totalRewards;
return address(pot);
}
Rewards breakdown
nSLOC
106This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.