Submission Details
Severity:
`cancelFlow()` can be frontrun and a wrong depositId will be used
Summary
If the keeper wants to cancel the current flow, he will use the current counter, but if the user had just created one before that, it will try to cancel the just created flow, not the one we intended.
We should be able to put a param in cancelFlow(), which will be counter, so it can correctly delete the intended depositInfo
Impact
Deleting an unintended deposit - broken functionality.
Tools Used
Manual review
Recommendations
Have a param that is configurable by the user.
Prize pool breakdown
Total prize
50,000 USDC
nSLOC
1,91026
USDC / LOC
47,500
2,500
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.