Submission Details
Severity:
Lack of Payment Validation
Summary
The trickOrTreat() function does not strictly validate the msg.value against the required amount, which can lead to overpayments or underpayments.
Vulnerability Details
Function: trickOrTreat()
Code Reference:
require(msg.value >= requiredCost, "Insufficient ETH sent for treat");
While the contract checks if the sent ETH is at least requiredCost, it doesn’t enforce exact amounts.
Impact
This could lead to user errors or unintended behavior, especially in the case of overpayments where users send more than necessary.
Tools Used
Manual Code Review
Recommendations
Enforce strict equality for the msg.value:
require(msg.value == requiredCost, "Incorrect ETH amount sent");
Rewards breakdown
nSLOC
109This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.