Submission Details
Severity:
Missing Minimum Deposit Requirement
Summary
The contract allows deposits of any amount, including zero, which could be used for griefing attacks.
Vulnerability Details
Malicious users can exploit this to front run or disrupt operations, cause storage inefficiency, and trigger unnecessary computation due to the lack of a minimum deposit requirement.
function deposit(address _token, uint256 _amount) external beforeDeadline {
// No minimum amount check
if (participant[msg.sender]) {
balances[msg.sender][_token] += _amount;
}
}
Impact
call deposit with _amount = 1 to get registered, and front-run future deposits.
Users can register with minimal amounts
Potential for spam registrations
Tools Used
Foundry
Recommendations
uint256 public constant MINIMUM_DEPOSIT = 1e15;
function deposit(address _token, uint256 _amount) external beforeDeadline {
require(_amount >= MINIMUM_DEPOSIT, "Deposit too small");
// Rest of the function
}
Rewards breakdown
nSLOC
129This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.