The transferReward
function will transfer a msg.sender
's rewards to another user. The last line of the function deletes the rewards in a certain index, because it has been transferred to the other user. However, the function relies on the length of that array to make sure that the index is in it. Deleting the element in the mapping will not shorten the length. Thus a malicious user could pass in the same index an still transfer rewards that are not theirs anymore.
This will cause errors when the code will go through the require line. Consider this scenario and test that can be implemented in the test file:
1. Alice transfers her rewards to Bob.
2. The function will transfer the rewards.
3. Then it will delete the elements. Not changing the length of the array.
4. Alice passes the same index to the function. It will pass the require.
5. Alice transfers more rewards, the same one she already transferred.
6. Bob can withdraw the funds that he shouldn't have.
Manual review, unit test
Consider using a nested mapping instead of array, this way there is no reason to check for length:
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.