Submission Details
Impact:
Likelihood:
Strict Equality Risk
Root + Impact
Description
-
Whitelist array length determines JSON entry count.
-
Fixed-length array iteration assumes static size, causing overflow/underflow if modified.
// string[] whitelist = new string[](5); // @> Fixed-size array
// In _createJSON():
for (uint i; i < 5; i++) { // @> Hardcoded length assumption
// Accesses whitelist[i]
}
Risk
Likelihood:
Guaranteed during whitelist size changes
High when refactoring code
Certain during dynamic input integration
Impact:
Array index out-of-bounds reverts
Incomplete JSON generation
Undetected data truncation
Proof of Concept
// Developer adds 6th address without updating loop
whitelist.push(vm.toString(makeAddr("frank")));
// Accessing whitelist[5] reverts
Recommended Mitigation
- for (uint i; i < 5; i++) {
+ for (uint i; i < whitelist.length; i++) {
// Process entry
}
Rewards breakdown
nSLOC
215This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.