BriVault
First Flight #52
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: medium
Invalid

Lack of input validation allows invalid team IDs

eze001

Root + Impact

Description

  • The contract does not validate team IDs during deposit or betting. Users can deposit with invalid team IDs (outside the expected range), causing incorrect accounting, misallocation of shares, or potential errors in winner calculations.

// Root cause in the codebase with @> marks to highlight the relevant section
pragma solidity ^0.8.0;
​
interface IERC20 { function transferFrom(address, address, uint256) external returns (bool); }
​
contract TeamIDValidationDescription {
IERC20 public asset;
mapping(uint256 => uint256) public teamAssets;
mapping(address => uint256) public userShares;
mapping(address => uint256) public userTeam;
​
function deposit(uint256 amount, uint256 teamId) external {
@> asset.transferFrom(msg.sender, address(this), amount);
@> teamAssets[teamId] += amount; // no validation of teamId
@> userShares[msg.sender] += amount;
@> userTeam[msg.sender] = teamId;
}
}
​

Risk

Likelihood:

  • Occurs whenever a user deposits tokens specifying a team ID that is not valid (e.g., negative, zero, or greater than the number of teams).

  • Occurs whenever the contract does not enforce a whitelist or bounds check on team IDs.

Impact:

  • Impact 1: Shares may be allocated to non-existent teams, making payouts incorrect or impossible.

  • Impact 2: Attackers could exploit invalid IDs to create accounting inconsistencies or grief honest participants.

Proof of Concept

Explanation:
The deposit function blindly accepts any teamId and updates teamAssets and userTeam mappings, allowing invalid IDs to corrupt accounting.

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;
​
contract MaliciousDeposit {
TeamIDValidationDescription public vault;
IERC20 public token;
​
constructor(TeamIDValidationDescription _vault, IERC20 _token) {
vault = _vault;
token = _token;
}
​
function depositInvalidTeam(uint256 amt) external {
token.transferFrom(msg.sender, address(vault), amt);
vault.deposit(amt, 9999); // invalid team ID
}
}
​

Recommended Mitigation

Explanation:Add a check to ensure the teamId is within the valid range before accepting deposits. This prevents invalid IDs from corrupting accounting and ensures payouts are always correct.

- function deposit(uint256 amount, uint256 teamId) external {
- asset.transferFrom(msg.sender, address(this), amount);
- teamAssets[teamId] += amount;
- userShares[msg.sender] += amount;
- userTeam[msg.sender] = teamId;
- }
+ uint256 public constant MAX_TEAM_ID = 1; // adjust based on actual number of teams
+
+ function deposit(uint256 amount, uint256 teamId) external {
+ require(teamId <= MAX_TEAM_ID, "invalid team ID");
+ asset.transferFrom(msg.sender, address(this), amount);
+ teamAssets[teamId] += amount;
+ userShares[msg.sender] += amount;
+ userTeam[msg.sender] = teamId;
+ }
​
Updates

Appeal created

bube Lead Judge 19 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!