BriVault
First Flight #52
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

`BriVault::withdraw` can revert due to division by zero when total participant shares are zero

sulfurpt

Root + Impact

Description

  • The `withdraw()` function calculates the user’s share using a division by `totalParticipantShares`.

    If no participants have joined the event yet (or `totalParticipantShares` is zero), the division will revert with a panic (`division by zero`).

// BriVault::withdraw
uint256 userShare = (balanceOf(msg.sender) * eventBalance) / totalParticipantShares;

Risk

Impact:

  • Users are unable to withdraw funds when `totalParticipantShares` is zero.

  • This creates a Denial-of-Service (DoS) vector for the withdraw function.

  • No direct theft of funds occurs, but it can block legitimate withdrawals and disrupt event logic.

Proof of Concept

1. User1 deposits tokens and joins the event.
2. Owner sets the winner and totalParticipantShares is zero.
3. User1 attempts to withdraw.
4. Transaction reverts with panic 0x12 (division by zero).

Add the following to `briVault.t.sol`

function test_POC_WithdrawDivByZero() public {
uint256 depositAmount = 1 ether;
​
// user1 approves and deposits
vm.prank(user1);
mockToken.approve(address(briVault), depositAmount);
​
vm.prank(user1);
briVault.deposit(depositAmount, user1);
​
// user1 joins event
vm.prank(user1);
briVault.joinEvent(0);
​
// warp time to after event ends
vm.warp(eventEndDate + 1);
​
// owner sets winner (no shares accumulated yet)
vm.prank(owner);
briVault.setWinner(5);
​
// expect revert when user1 tries to withdraw
vm.prank(user1);
vm.expectRevert();
briVault.withdraw();
}

Recommended Mitigation

Add a check to ensure `totalParticipantShares > 0` before dividing, to prevent a division by zero:

- uint256 userShare = (balanceOf(msg.sender) * eventBalance) / totalParticipantShares;
+ if (totalParticipantShares == 0) revert NoShares();
+ uint256 userShare = (balanceOf(msg.sender) * eventBalance) / totalParticipantShares;
Updates

Appeal created

bube Lead Judge 21 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Division by Zero in Withdraw Function When No Winners Bet on Winning Team

When no one bet on the winning team, making totalWinnerShares = 0, causing division by zero in withdraw and preventing any withdrawals.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!