Submission Details
Severity:
Using `delete` method does not change the `length` of the array in `rewardsOwned` mapping
Summary
In transferReward and claimSingleReward function we use deleteto remove a reward from an array in the
mapping rewardsOwned, but it does not change the length of the array after deleting an element.
function transferReward(address _to, uint256 _index) public {
require(_index < rewardsOwned[msg.sender].length, "Invalid index");
rewardsOwned[_to].push(rewardsOwned[msg.sender][_index]);
- delete rewardsOwned[msg.sender][_index];
}
Impact
If user will use this protocol for a long time and then use claimAllRewardsfunction , it must use for loopfor the array and it can cause extra gas for the user.
Recommendations
Change the logic.
Updates
Appeal created
inallhonesty about 1 year ago
Submission Judgement Published Assigned finding tags:
A user can poison the `rewardsOwned` of another user via `transferReward` of an empty reward index
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.