BriVault
First Flight #52
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

State variables are not update after participant cancels his participation

hunterspartan5

Root + Impact

Description

  • In cancelParticipation(); function, numberOfParticipants and totalParticipantShares state variables are not been updated after the user cancels his participation. This is due to the fact that when the user participates ie: by calling the joinEvent(); function in the last two lines numberOfParticipants and totalParticipantShares are been updated. Thus, for cancelling the participation it should be cancelled too.

// Root cause in the codebase with @> marks to highlight the relevant section
function joinEvent(uint256 countryId) public {
...
// updating numberOfParticipants and totalParticipantShares
numberOfParticipants++;
totalParticipantShares += participantShares;
​
emit joinedEvent(msg.sender, countryId);
}
​
function cancelParticipation () public {
if (block.timestamp >= eventStartDate){
revert eventStarted();
}
​
uint256 refundAmount = stakedAsset[msg.sender];
​
stakedAsset[msg.sender] = 0;
​
uint256 shares = balanceOf(msg.sender);
_burn(msg.sender, shares);
​
IERC20(asset()).safeTransfer(msg.sender, refundAmount);
// No updation takes place for numberOfParticipants and totalParticipantShares state variables
​
}

Risk

Likelihood:

  • Whenever a user cancels his participation.

Impact:

  • Error in accounting.

Proof of Concept

​

Recommended Mitigation

  • Update the state variables properly when the user cancels his participation.

- remove this code
+ add this code
function cancelParticipation () public {
if (block.timestamp >= eventStartDate){
revert eventStarted();
}
​
uint256 refundAmount = stakedAsset[msg.sender];
​
stakedAsset[msg.sender] = 0;
​
uint256 shares = balanceOf(msg.sender);
_burn(msg.sender, shares);
​
IERC20(asset()).safeTransfer(msg.sender, refundAmount);
+ numberOfParticipants--;
+ totalParticipantShares -= _convertToShares(stakedAsset[msg.sender]);
​
}
Updates

Appeal created

bube Lead Judge 19 days ago
Submission Judgement Published
Validated
Assigned finding tags:

`cancelParticipation` Leaves Stale Winner Data

CancelParticipation burns shares but leaves the address inside usersAddress and keeps userSharesToCountry populated.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!