BriVault
First Flight #52
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: high
Invalid

The values returned by the function are not utilized

hunterspartan5

Root + Impact

Description

  • In setWinner function of briVault - _getWinnerShares(); and _setFinallizedVaultBalance(); function are called to update the totalWinnerShares and finalizedVaultAsset state variables respectively. Both of these functions return these two state values too but they are not been stored and utilised in the below function or anywhere in the protocol. The main motive to call those functions was to update the state variables and there is no need to return any values.

// Root cause in the codebase with @> marks to highlight the relevant section
function setWinner(uint256 countryIndex) public onlyOwner returns (string memory) {
if (block.timestamp <= eventEndDate) {
revert eventNotEnded();
}
​
require(countryIndex < teams.length, "Invalid country index");
​
if (_setWinner) {
revert WinnerAlreadySet();
}
​
winnerCountryId = countryIndex;
winner = teams[countryIndex];
​
_setWinner = true;
​
_getWinnerShares();
​
_setFinallizedVaultBalance();
​
emit WinnerSet (winner);
return winner;
​
}

Risk

Likelihood:

  • Whenever a winner is set by the owner this thing will occur.

Impact:

  • There is just an info level bug. There is no financial loss to any user or to the protocol.

Proof of Concept

​

Recommended Mitigation

  • Removing the return type from _getWinnerShares(); and _setFinallizedVaultBalance(); function.

function _setFinallizedVaultBalance () internal
- returns (uint256)
{
if (block.timestamp <= eventStartDate) {
revert eventNotStarted();
}
​
- return
finalizedVaultAsset = IERC20(asset()).balanceOf(address(this));
}
​
​
function _getWinnerShares () internal
- returns (uint256)
{
for (uint256 i = 0; i < usersAddress.length; ++i){
address user = usersAddress[i];
totalWinnerShares += userSharesToCountry[user][winnerCountryId];
}
-return totalWinnerShares;
}
​
Updates

Appeal created

bube Lead Judge 19 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!