Submission Details
Severity:
Check on totalWinnerShares
Root + Impact
Description
If check <> 0 is not done in totalWinnerShares function will revert as below is diving by zero
if (
keccak256(abi.encodePacked(userToCountry\[msg.sender])) !=
keccak256(abi.encodePacked(winner))
) {
revert didNotWin();
}
uint256 shares = balanceOf(msg.sender);
uint256 vaultAsset = finalizedVaultAsset;
@> uint256 assetToWithdraw = Math.mulDiv(shares, vaultAsset, totalWinnerShares);
Risk
Likelihood:
Medium. It will happen when there is no winners.
Impact:
Low. Error will be raised. Maybe should be thought the case when there is no winners to avoid the assests remain blocked in the contract.
Proof of Concept
-
The owner sets a winner.
-
There is no winner.
-
If withdraw is attempted, error is raised.
Recommended Mitigation
/**
@dev allows users to withdraw.
*/
function withdraw() external winnerSet {
if (block.timestamp < eventEndDate) {
revert eventNotEnded();
}
+ if (totalWinnerShares == 0) {
+ revert thereAreNotWinners();
+ }
if (
keccak256(abi.encodePacked(userToCountry[msg.sender])) !=
keccak256(abi.encodePacked(winner))
) {
revert didNotWin();
}
uint256 shares = balanceOf(msg.sender);
uint256 vaultAsset = finalizedVaultAsset;
uint256 assetToWithdraw = Math.mulDiv(shares, vaultAsset, totalWinnerShares);
_burn(msg.sender, shares);
IERC20(asset()).safeTransfer(msg.sender, assetToWithdraw);
emit Withdraw(msg.sender, assetToWithdraw);
}
Updates
Appeal created
bube 19 days ago
Submission Judgement Published Assigned finding tags:
Division by Zero in Withdraw Function When No Winners Bet on Winning Team
When no one bet on the winning team, making totalWinnerShares = 0, causing division by zero in withdraw and preventing any withdrawals.
Rewards breakdown
nSLOC
193This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.