BriVault
First Flight #52
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Mapping 'userSharesToCountry' does not changed in function 'cancelParticipation' causing incorrect payouts for winners

al88nsk

Description

Function BriVault::joinEvent sets mapping userSharesToCountry value to the user's shares for the user and selected country:

uint256 participantShares = balanceOf(msg.sender);
userSharesToCountry[msg.sender][countryId] = participantShares;

However, when user cancels participation, the mapping stays unchanged:

function cancelParticipation () public {
if (block.timestamp >= eventStartDate){
revert eventStarted();
}
​
uint256 refundAmount = stakedAsset[msg.sender];
​
stakedAsset[msg.sender] = 0;
​
uint256 shares = balanceOf(msg.sender);
_burn(msg.sender, shares);
​
IERC20(asset()).safeTransfer(msg.sender, refundAmount);
}

This mapping affects calculation of totalWinnerShares that is used to calculate asset amounts to transfer to winners:

function _getWinnerShares () internal returns (uint256) {
​
for (uint256 i = 0; i < usersAddress.length; ++i){
address user = usersAddress[i];
totalWinnerShares += userSharesToCountry[user][winnerCountryId];
}
return totalWinnerShares;
}

So, it makes calculation of assets amounts transferred to winners incorrect since user has no shares, but they are included in totalWinnerShares value:

uint256 assetToWithdraw = Math.mulDiv(shares, vaultAsset, totalWinnerShares);

Risk

Likelihood:

High, since it happens every time any user cancels participation.

Impact:

High, since winners receive less assets than they must receive.

Recommended Mitigation

Delete mapping userSharesToCountry value for the user when the user cancels participation.

Updates

Appeal created

bube Lead Judge 19 days ago
Submission Judgement Published
Validated
Assigned finding tags:

`cancelParticipation` Leaves Stale Winner Data

CancelParticipation burns shares but leaves the address inside usersAddress and keeps userSharesToCountry populated.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!