Submission Details
Severity: high
ValidReentrancy Vulnerability in `withdraw` Function Allows Unlimited Token Withdrawal
Updates
Lead Judging Commences
Submission Judgement Published
Validated
Assigned finding tags:
finding-TokenManager-withdraw-userTokenBalanceMap-not-reset
Valid critical severity finding, the lack of clearance of the `userTokenBalanceMap` mapping allows complete draining of the CapitalPool contract. Note: This would require the approval issues highlighted in other issues to be fixed first (i.e. wrong approval address within `_transfer` and lack of approvals within `_safe_transfer_from` during ERC20 withdrawals)
Prize pool breakdown
Total prize
30,000 USDC
nSLOC
1,22924 USDC / LOC
High Medium
25,000 USDC
Low
2,750 USDC
Judges
2,250 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Community Judging
Submissions are being reviewed by the community.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.