Submission Details
Impact:
Likelihood:
APT Coin Registration Failure and Claim Blocking Risk
Root + Impact
Description
Users’ APT coin registration is called before claim. If this registration fails, the claim will stop but error management is insufficient.
if (!coin::is_account_registered<AptosCoin>(user_addr)) {
coin::register<AptosCoin>(user);
} @> // No failure detection or handling
Risk
Likelihood:
User registration for APT account may fail in some cases.
Impact:
-
Poor user experience and failed claims.
-
Potential loss or lockout of user funds.
Proof of Concept
Claim cannot proceed if user registration fails.
Recommended Mitigation
-if (!coin::is_account_registered<AptosCoin>(user_addr)) {
- coin::register<AptosCoin>(user);
-}
+if (!coin::is_account_registered<AptosCoin>(user_addr)) {
+ let result = coin::register<AptosCoin>(user);
+ if (!result.success) {
+ abort E_REGISTRATION_FAILED; // Abort if registration fails
+ }
+}
Rewards breakdown
nSLOC
125This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.