Root + Impact

Description

The PizzaDrop contract generates reward amounts in base Octas instead of APT tokens as advertised. Users receive microscopic amounts (0.000001-0.000005 APT) instead of the promised substantial rewards (100-500 APT).

The get_random_slice() function generates random values between 100-500 without converting to proper APT decimals (multiplying by 10^8 Octas per APT).

Risk

Likelihood:

• Every user registration triggers this bug automatically

• 100% of participants receive incorrect reward amounts

• No special conditions required for exploitation

Impact:

• Users receive 55,248,619x less value than advertised

• Complete protocol failure - advertised value proposition becomes worthless

• Reputational damage and potential legal issues for false advertising

Proof of Concept

This vulnerability occurs every time a user is registered. The following steps demonstrate the issue: 1. Contract is deployed and funded with APT 2. Owner registers any user via register_pizza_lover() 3. get_random_slice() assigns 100-500 raw values as "APT amounts" 4. User claims and receives microscopic amounts instead of substantial rewards The PoC above shows a user assigned 181 Octas (0.00000181 APT) when expecting 100-500 APT - a difference of over 55 million times less value.

Recommended Mitigation

The fix requires proper decimal conversion when generating reward amounts. Instead of using raw numbers, multiply by the APT decimal factor (100,000,000 Octas per APT) to ensure users receive the advertised token amounts rather than base units. This ensures the random range 100-500 represents actual APT tokens as described in the project documentation.