MyCut
First Flight #23
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Lack of checking if `totalReward` is equal to total value of `rewards` array in `Pot::constructor`. Users may not be able call `claimCut` or owner have to send more money than needed.

kazan

Description:

The Pot::constructor take an array param of rewards for each player and a param of totalReward. The total value of rewards array need to equal the totalReward value. But the constructor do not check for this.

Impact:

If the totalReward value is larger than total value of rewards array, the Owner will have to send more token than needed. And if totalReward value is smaller than total value of rewards array, claimCut will revert when player call because the Pot contract doesn't have enough token and causing arithmetic underflow.

Proof of Concept:

The total value of rewards array is 4. The owner fund the contest with the totalRewards of 3. After Player 1 claim cut, player 2 can not claim.

Paste this test into TestMyCut.t.sol, test will pass.

function testCanFundPotWrongAmount() public mintAndApproveTokens {
vm.startPrank(user);
contest = ContestManager(conMan).createContest(
players,
rewards,
IERC20(ERC20Mock(weth)),
3
);
ContestManager(conMan).fundContest(0);
vm.stopPrank();
​
vm.startPrank(player1);
Pot(contest).claimCut();
vm.stopPrank();
​
vm.startPrank(player2);
vm.expectRevert();
Pot(contest).claimCut();
vm.stopPrank();
}

Tools Used:

Manual review

Foundry

Recommendations:

Add checking to ensure the totalRewards value is equal to total value of rewards array.

constructor(
address[] memory players,
uint256[] memory rewards,
IERC20 token,
uint256 totalRewards
) {
i_players = players;
i_rewards = rewards;
i_token = token;
i_totalRewards = totalRewards;
remainingRewards = totalRewards;
i_deployedAt = block.timestamp;
​
+ uint256 totalValue;
​
for (uint256 i = 0; i < i_players.length; i++) {
playersToRewards[i_players[i]] = i_rewards[i];
+ totalValue += i_rewards[i];
}
​
+ if (totalValue != totalRewards) {
+ revert();
+ }
}
Updates

Lead Judging Commences

equious Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Known issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.