Submission Details
Impact:
Likelihood:
Double Claim Vulnerability
Root + Impact
Description
Users can call claim_pizza_slice multiple times if claimed_users updated after transfer.
table::add(&mut state.claimed_users, user_addr, true); // @> after transfer
Risk
Likelihood:
Attacker calls claim repeatedly before state updated.
Impact:
Same user claims multiple slices, draining pool.
Proof of Concept
// Call claim_pizza_slice twice quickly, receive double payout
Recommended Mitigation
- table::add(&mut state.claimed_users, user_addr, true);
+ table::add(&mut state.claimed_users, user_addr, true); // move before transfer
Rewards breakdown
nSLOC
125This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.