Submission Details
Impact:
Likelihood:
[H-2] The `cancelParticipation()` function allows for zero-deposit call. This could leads to a potential Denial of Service attack in the future.
Root + Impact
The `cancelParticipation()` function allows for zero-deposit call. This could leads to a potential Denial of Service attack in the future.
Description
`cancelParticipation()` does not check that the caller has a non-zero deposit. A caller with `stakedAsset[msg.sender] == 0` can execute the function; this lets the contract continue past effects/interactions (burn, token transfer) even when there is nothing to cancel. Separately, when a real participant cancels, the function fails to decrement `totalParticipantShares`, leaving the global share counter stale.
// Root cause in the codebase, no check for zero
//deposit, as function still run with zero deposit
function cancelParticipation() public {
if (block.timestamp >= eventStartDate) {
revert eventStarted();
}
uint256 refundAmount = stakedAsset[msg.sender];
stakedAsset[msg.sender] = 0;
uint256 shares = balanceOf(msg.sender);
_burn(msg.sender, shares);
IERC20(asset()).safeTransfer(msg.sender, refundAmount);
}
Risk
Likelihood:
This is very likely to occur when malicious addresses keeps calling the
cancelParticipation()function. If the address calls the function a Million times with zero-deposit, this function will execute a Million times too. There is a very high chances there will be a Denial-of Service attack in the future.
Impact:
The `cancelParticipation()` function lacks a zero-deposit check, an attacker can keep calling the function million times and it will execute million times as well. Thus this will cause an increase in `gasFee` for calling the `cancelParticipation()` function, therefore causing a Denial of Service (DoS) for future participant.
Proof of Concept
function test_userCanCallCancelParticipationWithZeroDeposit() public {
uint256 totalSharesBeforeEntry = briVault.totalParticipantShares();
vm.startPrank(user1);
briVault.cancelParticipation();
vm.stopPrank();
uint256 totalSharesAfterUser1CancelParticipation = briVault.totalParticipantShares();
assertEq(totalSharesBeforeEntry, totalSharesAfterUser1CancelParticipation);
}
Recommended Mitigation
// Add check for zero deposit using custom error to revert. As seen below;
// Add this check to prevent future DoS attack
// make sure to follow the CEI fomart
+ if (refundAmount == 0) {
revert briVault__NoDepositToCancel();
}
Rewards breakdown
nSLOC
193This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.