Submission Details
Severity:
Not fully checking the length
Summary
The transferReward function checks the index based on the length of the rewardsOwned but it does not check the last reward in the array
Vulnerability Details
In the following line we can see that the requirement is that the index is smaller than the rewardOwned length.
require(_index < rewardsOwned[msg.sender].length, "Invalid index");
It should check the whole length the same way the claimSingleReward function checks meaning it should be:
require(_index <= rewardsOwned[msg.sender].length, "Invalid index");
Impact
This vulnerability kinda breaks the logic of the contract since it doesnt correctly check the full array.
Tools Used
Manual
Recommendations
function transferReward(address _to, uint256 _index) public {
- require(_index < rewardsOwned[msg.sender].length, "Invalid index");
+ require(_index <= rewardsOwned[msg.sender].length, "Invalid index");
rewardsOwned[_to].push(rewardsOwned[msg.sender][_index]);
delete rewardsOwned[msg.sender][_index];
}
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.