Submission Details
Severity:
No Token Transfer Validation Enables Underpayment Exploit
Summary
The joinGame function uses transferFrom() but does not verify how many tokens were actually received. This opens up underpayment exploits with ERC20s that include fees or have broken implementations.
Vulnerability Details
IERC20(token).transferFrom(msg.sender, address(this), betAmount);
This code assumes success and the full amount, but certain tokens (e.g., fee-on-transfer tokens) reduce the transferred amount.
Impact
Malicious users may join games without committing the full stake.
Honest users are at financial disadvantage.
Tools Used
Manual review
Custom ERC20 mocks with fee-on-transfer behavior
Recommendations
Validate the contract balance before and after:
uint256 before = IERC20(token).balanceOf(address(this));
IERC20(token).transferFrom(...);
uint256 after = IERC20(token).balanceOf(address(this));
require(after - before == betAmount, "Incorrect token amount received");
Rewards breakdown
nSLOC
349This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.