Trick or Treat
First Flight #27
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Strict equality in randomized price checks may cause missed discounts or overcharges in `trickOrTreat` function

sstoqnov_

Summary

The trickOrTreat function uses strict equality checks (==) to determine pricing tiers based on random numbers. This implementation is problematic as it creates an overly precise comparison that could fail to evaluate as true due to minor deviations (such as rounding or unexpected extra contributions), potentially causing users to miss out on intended price discounts or multipliers.

Vulnerability Details

if (random == 1) {
costMultiplierNumerator = 1;
costMultiplierDenominator = 2;
} else if (random == 2) {
costMultiplierNumerator = 2;
costMultiplierDenominator = 1;
}

Issues here:

  1. Strict equality (==) is used to check for exact values 1 and 2

  2. No range checks or fallback conditions

  3. Single point of failure in price determination

  4. Assumption that random number will always fall exactly on these values

Impact

The strict equality check in the trickOrTreat function introduces potential issues in pricing determination for users. Since the function relies on the random variable precisely matching 1 or 2 for discounted or increased pricing, any deviation results in the normal pricing tier by default. This precision may lead to missed discounts.

Tools Used

  • Manual Review

  • Slither

  • Foundry

Recommendations

The solution might be this as follow:

if (random <= 10) {
costMultiplierNumerator = 1;
costMultiplierDenominator = 2;
} else if (random <= 20) {
costMultiplierNumerator = 2;
costMultiplierDenominator = 1;
}
​
Updates

Appeal created

bube Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.