Submission Details
Impact:
Likelihood:
Reentrancy in claim_pizza_slice
Root + Impact
Description
Normally, users can claim their pizza slice once. However, external calls are made before updating the user’s balance, enabling reentrancy.
The claim function updates state after transferring coins, enabling reentrancy.
coin::transfer<AptosCoin>(&resource_signer, to, amount); // @> external transfer before state update
Risk
Likelihood:
-
If attacker calls claim_pizza_slice with a contract, fallback may reenter.
-
Possible in high-traffic airdrops.
Impact:
-
Contract balance can be drained.
-
Multiple claims possible for same user.
Proof of Concept
// Deploy a malicious contract that calls claim_pizza_slice in fallback repeatedly
Recommended Mitigation
- coin::transfer<AptosCoin>(&resource_signer, to, amount);
+ table::add(&mut state.claimed_users, user_addr, true);
+ state.balance = state.balance - amount;
+ coin::transfer<AptosCoin>(&resource_signer, to, amount);
Rewards breakdown
nSLOC
125This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.