Submission Details
Severity:
Deposit limit control flaw in `UpliftOnlyExample` contract
Summary
The UpliftOnlyExample contract's DoS protection mechanism allows 101 deposits instead of the documented limit 100 due to incorrect comparison logic.
Vulnerability Details
if (poolsFeeData\[pool]\[msg.sender].length > 100) {
revert TooManyDeposits(pool, msg.sender);\
}
The check uses > instead of >=, allowing users to make 101 deposits, violating the contract's documented security measure.
Impact
Allows users to create 101 deposits instead of the intended maximum of 100
Violates the explicit DoS protection mechanism
Could potentially affect gas costs and storage optimization assumptions
Tools Used
Manual code review
Recommendations
if (poolsFeeData[pool][msg.sender].length >= 100) {
revert TooManyDeposits(pool, msg.sender);
}
Updates
Lead Judging Commences
n0kto 10 months ago
Submission Judgement Published Reason: Non-acceptable severity
Assigned finding tags:
invalid_Uplift_101_deposit_strict_equal
Only 1 more NFT won’t have any impact. Informational.
Prize pool breakdown
Total prize
49,600 OP
nSLOC
3,00017
OP / LOC
44,640
4,960
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.