Submission Details
Impact:
Likelihood:
Insufficient Fund Assertion Timing
Root + Impact
Description
balance checked before registration; race condition possible.
assert!(state.balance >= amount, E_INSUFFICIENT_FUND); // @> before updating claimed_users
Risk
Likelihood:
Multiple claims could temporarily bypass balance check.
Impact:
Potential over-withdrawal of pool funds.
Proof of Concept
// Two users claim almost simultaneously
Recommended Mitigation
+ table::add(&mut state.claimed_users, user_addr, true);
+ state.balance = state.balance - amount;
- assert!(state.balance >= amount, E_INSUFFICIENT_FUND);
+ assert!(state.balance >= 0, E_INSUFFICIENT_FUND);
Rewards breakdown
nSLOC
125This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.