Submission Details
Severity:
transferReward Deletes Reward Without Shifting Array
Summary
The transferReward function uses delete to remove a reward from the rewardsOwned array, but this leaves a "gap" in the array, causing issues when iterating through it. This can result in lost rewards or unintentional behavior when trying to access elements later.
The array should maintain a continuous structure after transferring a reward.
Impact
lost rewards or unintentional behavior when trying to access elements later.
Tools Used
manual
Recommendations
Instead of using delete, consider shifting the array elements after removing a reward:
function transferReward(address _to, uint256 _index) public {
require(_index < rewardsOwned[msg.sender].length, "Invalid index");
rewardsOwned[_to].push(rewardsOwned[msg.sender][_index]);
// Shift the array elements left to fill the gap
for (uint256 i = _index; i < rewardsOwned[msg.sender].length - 1; i++) {
rewardsOwned[msg.sender][i] = rewardsOwned[msg.sender][i + 1];
}
rewardsOwned[msg.sender].pop();
}
Updates
Appeal created
inallhonesty about 1 year ago
Submission Judgement Published Assigned finding tags:
A user can poison the `rewardsOwned` of another user via `transferReward` of an empty reward index
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.