Submission Details
Severity:
function deposit()
Summary
The deposit function in the contract allows users to deposit tokens but does not check if the _amount being deposited is greater than zero.
Vulnerability Details
The deposit function does not enforce a minimum deposit amount, allowing users to call the function with _amount = 0.
function deposit(address _token, uint256 _amount) external beforeDeadline {
if(!whitelisted[_token]) {
revert NotSupportedToken();
}
if(participant[msg.sender]){
balances[msg.sender][_token] += _amount;
IERC20(_token).safeTransferFrom(msg.sender, address(this), _amount);
emit GenerousAdditionalContribution(msg.sender, _amount);
} else {
participant[msg.sender] = true;
balances[msg.sender][_token] += _amount;
IERC20(_token).safeTransferFrom(msg.sender, address(this), _amount);
emit NewSignup(msg.sender, _amount, getParticipationStatus(msg.sender));
}
}
Impact
Inconsistent Balances:
-
Inconsistent Balances:
Zero-value deposits update the
balancesmapping unnecessarily.
-
Misleading Events:
Zero-value transactions emit events, falsely suggesting that contributions were made.
Tools Used
Manual review
Recommendations
Add a require check to ensure that _amount > 0 at the start of the deposit function.
function deposit(address _token, uint256 _amount) external beforeDeadline {
require(amount > 0, "Amount must be greater than zero");
if(!whitelisted[_token]) {
revert NotSupportedToken();
}
if(participant[msg.sender]){
balances[msg.sender][_token] += _amount;
IERC20(_token).safeTransferFrom(msg.sender, address(this), _amount);
emit GenerousAdditionalContribution(msg.sender, _amount);
} else {
participant[msg.sender] = true;
balances[msg.sender][_token] += _amount;
IERC20(_token).safeTransferFrom(msg.sender, address(this), _amount);
emit NewSignup(msg.sender, _amount, getParticipationStatus(msg.sender));
}
}
Rewards breakdown
nSLOC
129This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.