Submission Details
Severity:
Lack of Ownership Check in get_random_slice
Root + Impact
Description
-
get_random_slice should only be called by owner, but it's public.
-
Any user can register themselves with arbitrary random slice.
table::add(&mut state.users_claimed_amount, user_addr, random_amount); // @> no access control
Risk
Likelihood:
Any user can call the function repeatedly.
Impact:
Users can manipulate their slice amount.
Randomness integrity is broken.
Proof of Concept
// User calls get_random_slice multiple times to set a high claim amount
Recommended Mitigation
+ assert!(signer::address_of(owner) == state.owner, E_NOT_OWNER);
- table::add(&mut state.users_claimed_amount, user_addr, random_amount);
+ table::add(&mut state.users_claimed_amount, user_addr, random_amount);
Updates
Appeal created
bube 12 days ago
Submission Judgement Published Assigned finding tags:
Anyone can call `get_random_slice` function
Rewards breakdown
nSLOC
125This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.