BriVault
First Flight #52
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Incomplete state cleanup during cancellation can lead to theft of funds

bigchapo21

Root + Impact

Description

  • When a user cancels participation, assets are returned to the user then shares are burnt

  • The issue here is that the function fails to perform certain state updates, it fails to clear out user address from users array, doesn't remove user country mapping, and it fails to clear user shares, so even though a user cancels participation, he still participates because his data still persists. Now a scenario where a user deposits a large asset to bet on a country, and he cancels participations, and redeposits again, now his intially chosen country wins, user can go and claim rewards from the inflated shares due to his intial deposit, and because he has a current share due to the redeposit, he can claim rewards proportional to his redeposit

function cancelParticipation () public {
if (block.timestamp >= eventStartDate){
revert eventStarted();
}
​
uint256 refundAmount = stakedAsset[msg.sender];
​
stakedAsset[msg.sender] = 0;
//doesnt remove from usersAddress array
// doesnt remove from userToCountry mapping
//doesnt remove participant shares
//even after cancelling participation userSharesToCountry mapping remains. user can still win shares if their country wins
​
uint256 shares = balanceOf(msg.sender);
_burn(msg.sender, shares);
​
IERC20(asset()).safeTransfer(msg.sender, refundAmount);
}
​

Risk

Likelihood:

  • When user deposits, cancels participation, and redeposits again

Impact:

  • Attacker can carry out this attack sysmetically to drain protocol funds


Proof of Concept

​

Recommended Mitigation

​
+ delete userSharesToCountry[msg.sender];
+ delete userToCountry[msg.sender];
+ delete usersAddress[msg.sender];
A state cleanup must occur after user cancels participation
Updates

Appeal created

bube Lead Judge 21 days ago
Submission Judgement Published
Validated
Assigned finding tags:

`cancelParticipation` Leaves Stale Winner Data

CancelParticipation burns shares but leaves the address inside usersAddress and keeps userSharesToCountry populated.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!