Submission Details
Severity:
No Verification of Token Approval
Summary
The fundContest function does not verify if the ContestManager contract has been approved to transfer the required amount of tokens on behalf of the sender.
Vulnerability Details
The function proceeds with the transferFrom call without checking if the sender has granted sufficient allowance to the ContestManager.
Impact
If the allowance is insufficient, the transferFrom operation will fail, leading to failed transactions and an inability to fund contests as intended.
Tools Used
Manual Review
Recommendations
Verify the token allowance before proceeding with the transferFrom operation.
require(token.allowance(msg.sender, address(this)) >= totalRewards, "Insufficient allowance");
Rewards breakdown
nSLOC
106This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.