Submission Details
Severity:
REENTRANCY IN `transferReward()`
Summary:
The function first pushes the reward from, rewardOwned[msg.sender]at _index torewardsOwned[to]` then deletes the
reward at the given index from the senders reward list.
Vulnerability Details:
function transferReward(address \_to, uint256 \_index) public {
require(\_index < rewardsOwned\[msg.sender].length, "Invalid index");
rewardsOwned\[\_to].push(rewardsOwned\[msg.sender]\[\_index]);
delete rewardsOwned\[msg.sender]\[\_index];
}
Impact:
The reentrancy could lead to unexpected behaviour, such as transferring the same reward multiple times or corrupting the reward
list, which could lead to loss of funds or rewards.
Tools Used:
Solidity aderyn slither
Recommendations:
To mitigate this reentrancy follow the Checks Effect Interactions pattern.
You should make all state changes before calling an external function.
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.