BriVault
First Flight #52
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Contract has no way to withdraw assets if no user wins the tournament hence assets get stuck.

0xarinaitwe

Contract has no way to withdraw assets if no user wins the tournament hence assets get stuck.

Description

  • The BriVault contract has no function to withdraw the assets in case there is no winner for the tournament.

    When the tournament starts and ends with no users who bet on the winner country, the funds get stuck in the contract with no ways of withdrawing them, not even for the admin. This is inconsistency in design.

Risk

Likelihood:

This happens when no user wins the tournament.

Impact:

  • I consider the impact as medium because the users were not exploited, they just lost the bet, but also the funds are stuck in the contract with no means to withdraw them even for the admin.

Proof of Concept

Add this test to briVault.t.sol and run forge test --mt testFundsGetStuckIfThereIsNoUserWhoWins -vvvv

function setUp() public {
participationFeeBsp = 150; // 1.5%
eventStartDate = block.timestamp + 2 days;
eventEndDate = eventStartDate + 31 days;
participationFeeAddress = makeAddr("participationFeeAddress");
minimumAmount = 0.0002 ether;
​
mockToken = new MockERC20("Mock Token", "MTK");
​
mockToken.mint(owner, 20 ether);
mockToken.mint(user1, 20 ether);
mockToken.mint(user2, 20 ether);
mockToken.mint(user3, 20 ether);
mockToken.mint(user4, 20 ether);
mockToken.mint(user5, 20 ether);
​
vm.startPrank(owner);
briVault = new BriVault(
IERC20(address(mockToken)), // replace `address(0)` with actual _asset address
participationFeeBsp,
eventStartDate,
participationFeeAddress,
minimumAmount,
eventEndDate
);
​
briVault.approve(address(mockToken), type(uint256).max);
​
// Admin sets countries
briVault.setCountry(countries);
​
vm.stopPrank();
}
​
function testFundsGetStuckIfThereIsNoUserWhoWins() public {
address[] memory users = new address[](4);
users[0] = makeAddr("1");
users[1] = makeAddr("2");
users[2] = makeAddr("3");
users[3] = makeAddr("4");
​
uint256 amount = 100 ether;
​
for (uint8 i; i < users.length; ++i) {
mockToken.mint(users[i], amount);
​
vm.startPrank(users[i]);
mockToken.approve(address(briVault), type(uint96).max);
briVault.deposit(amount, users[i]);
if (i == 3) {
briVault.joinEvent(5);
} else {
briVault.joinEvent(3);
}
​
vm.stopPrank();
}
​
// Warp the time for the event to start
vm.warp(block.timestamp + 2 days + 1 seconds);
// Warp the time for the event to end
vm.warp(block.timestamp + 31 days);
​
// Admin sets the winner
vm.startPrank(owner);
briVault.setWinner(10);
vm.stopPrank();
}

Recommended Mitigation

  • Add an onlyOwner function to refund a percentage of assets back to users whenever there are no users who win the tournament.

Updates

Appeal created

bube Lead Judge 19 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Division by Zero in Withdraw Function When No Winners Bet on Winning Team

When no one bet on the winning team, making totalWinnerShares = 0, causing division by zero in withdraw and preventing any withdrawals.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!