Submission Details
Impact:
Likelihood:
Function:_setFinallizedVaultBalance target IERC20(asset()).balanceOf(address(this)) as finalizedVaultAsset, ignoring maybe someone has deposited but not joined event.
[H-1] Function:_setFinallizedVaultBalance target IERC20(asset()).balanceOf(address(this)) as finalizedVaultAsset, ignoring maybe someone has deposited but not joined event.
Description
In Function:_setFinallizedVaultBalance (), set finalizedVaultAsset equal IERC20(asset()).balanceOf(address(this))
function _setFinallizedVaultBalance () internal returns (uint256) {
if (block.timestamp <= eventStartDate) {
revert eventNotStarted();
}
@> return finalizedVaultAsset = IERC20(asset()).balanceOf(address(this));
}
Impact
It will let people who has deposited the asset but not joined event loose their asset.
Proof of Concepts
You can run the test function in test/briVault.t.sol, and it will pass.
/**
* @dev Test that finalizedVaultAsset incorrectly includes funds from non-participating users
* Scenario:
* - user1 deposits and joins the event
* - user2 deposits but does not join the event
* Expected:
* - finalizedVaultAsset should include only user1's stake
* Actual:
* - finalizedVaultAsset includes user2's funds (bug)
*/
function test_incorrect_finalizedVaultAsset() public {
//user1 has deposited and joined event
vm.startPrank(user1);
mockToken.approve(address(briVault), 5 ether);
uint256 user1shares = briVault.deposit(5 ether, user1);
briVault.joinEvent(10);
console.log("user1 shares", user1shares);
vm.stopPrank();
//user2 has deposited but not joined event
vm.startPrank(user2);
mockToken.approve(address(briVault), 5 ether);
briVault.deposit(5 ether, user2);
vm.stopPrank();
//setwinner and caculate finalizedVaultAsset
vm.startPrank(owner);
briVault.setCountry(countries);
vm.warp(eventEndDate + 1);
briVault.setWinner(2);
vm.stopPrank();
//unfortunately, finalizedVaultAsset contains user2's assets
uint256 correctFinalized = briVault.stakedAsset(user1);
uint256 actualFinalized = briVault.finalizedVaultAsset();
assertGt(actualFinalized, correctFinalized, "finalizedVaultAsset incorrectly includes non-participant assets");
}
Recommended mitigation
function _setFinallizedVaultBalance () internal returns (uint256) {
if (block.timestamp <= eventStartDate) {
revert eventNotStarted();
}
- return finalizedVaultAsset = IERC20(asset()).balanceOf(address(this));
+ return finalizedVaultAsset = Math.mulDiv(IERC20(asset()).balanceOf(address(this)), totalParticipantShares, totalSupply());
}
Rewards breakdown
nSLOC
193This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.