BriVault
First Flight #52
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Division by Zero in Withdraw Function When No Winners Bet on Winning Team

stevenalenga

Risk

Likelihood

Owner sets a winner that no participants bet on.

Impact

Winners cannot withdraw funds, contract becomes unusable for withdrawals.

Reference Files

src/briVault.sol

Description

  • Normally, if a winner is set, there should be participants who bet on that team to allow proportional withdrawals based on their shares.

  • The issue occurs when no one bet on the winning team, making totalWinnerShares = 0, causing division by zero in withdraw and preventing any withdrawals.

uint256 assetToWithdraw = Math.mulDiv(shares, vaultAsset, totalWinnerShares); // @> Divides by totalWinnerShares which can be 0

Proof of Concept

Owner sets a winner with no bets, causing revert on withdraw.

function testDivisionByZero() public {
vm.startPrank(owner);
briVault.setCountry(countries);
vm.stopPrank();
​
vm.startPrank(user1);
mockToken.approve(address(briVault), 5 ether);
briVault.deposit(5 ether, user1);
briVault.joinEvent(1); // Bets on country 1
vm.stopPrank();
​
vm.warp(eventEndDate + 1);
vm.startPrank(owner);
briVault.setWinner(2); // Sets winner to country 2 with no bets, totalWinnerShares = 0
vm.stopPrank();
​
vm.startPrank(user1);
vm.expectRevert(); // Division by zero prevents withdrawal
briVault.withdraw();
vm.stopPrank();
}

Recommended Mitigation

Add a check in setWinner to ensure there are winners.

// In setWinner function, after _getWinnerShares();
+ require(totalWinnerShares > 0, "No winners bet on this team");
Updates

Appeal created

bryanconquer Lead Judge 16 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Division by Zero in Withdraw Function When No Winners Bet on Winning Team

When no one bet on the winning team, making totalWinnerShares = 0, causing division by zero in withdraw and preventing any withdrawals.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!