Absence of check for if treat already exists
Summary
The addTreat() function does not include check to verify treat existence.
Vulnerability Details
The addTreat() function defined in line 37 of the SpookySwap contract violates the Checks, Effects And Interactions pattern. This gives room for multiple treats with the same name or setting treat cost to zero without removing the treat.
Impact
Since the treat cost could be manipulated without removing the treat, treats could be swapped for zero cost. This harms the protocol and defeats its purpose
Tools Used
Manual Review
Recommendations
The addTreat() function should include a check to ensure treat existence before adding to the treat array.
Appeal created
[invalid] Duplicate treats
The function `addTreat` is called by the owner. The owner is trusted. There will be no duplicates.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.