Attackers can front-run honest users to inflate their position in the array, affecting share calculations.

Description

• The briVault::joinEvent function in the contract is vulnerable to front-running attacks. briVault::usersAddress array is used to iterate over participants in briVault::_getWinnerShares. An attacker can observe a pending transaction that calls briVault::joinEvent and submit their own transaction with a higher gas price to execute first. This allows the attacker to manipulate the state of the contract before the original transaction is processed, potentially leading to unfair advantages such as acquiring more shares or affecting the event's outcome.

Risk

Likelihood:

• Reason 1 // Describe WHEN this will occur (avoid using "if" statements)

• Reason 2

Impact:

• Impact 1

• Impact 2

Proof of Concept

Recommended Mitigation