BriVault
First Flight #52
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: high
Invalid

`BriVault::joinEvent` allows joining with an empty country ID

sulfurpt

Root + Impact

Description

  • The `joinEvent(uint256 countryId)` function does not validate the `_countryId` parameter.

  • A user can join an event specifying a `countryId` of `0` (or any invalid ID), which might represent a non-existent country.

// BriVault::joinEvent
userSharesToCountry[msg.sender][countryId] = participantShares;
usersAddress.push(msg.sender);
numberOfParticipants++;
totalParticipantShares += participantShares;

Risk

Impact:

  • Users can join events with invalid country IDs, potentially breaking reward distribution logic.

  • Metrics like `userSharesToCountry` and `totalParticipantShares` may become inconsistent with real-world expectations.

  • Downstream calculations assuming valid country IDs could behave incorrectly or be exploited for edge-case manipulations.

Proof of Concept

1. User1 deposits tokens.
2. User1 calls `joinEvent(0)` with an empty country ID.
3. Observe that `joinedEvent` is emitted and `userSharesToCountry` is recorded for country `0`.

Add the following to `briVault.t.sol`

function test_POC_EmptyCountryJoin() public {
uint256 depositAmount = 1 ether;
​
// user1 approves and deposits
vm.prank(user1);
mockToken.approve(address(briVault), depositAmount);
​
vm.prank(user1);
briVault.deposit(depositAmount, user1);
​
// user1 joins event with empty countryId
vm.prank(user1);
briVault.joinEvent(0);
​
// Assertions
uint256 recordedShares = briVault.userSharesToCountry(user1, 0);
uint256 balanceShares = briVault.balanceOf(user1);
​
assertEq(recordedShares, balanceShares, "userSharesToCountry recorded even with empty countryId");
assertEq(briVault.numberOfParticipants(), 1, "numberOfParticipants incremented");
}

Recommended Mitigation

Validate the `_countryId` to ensure it corresponds to a valid country. For example:

+ error InvalidCountryId();
+
function joinEvent(uint256 countryId) public {
+ if (countryId == 0) revert InvalidCountryId();
// existing logic
}
Updates

Appeal created

bube Lead Judge 19 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
sulfurpt Submitter
18 days ago
bube Lead Judge
15 days ago
bube Lead Judge 14 days ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!