BriVault
First Flight #52
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: high
Invalid

Vault limited to 48 countries, so players from a country without countryId will always revert

luigi

Vault limited to 48 countries, so players from a country without countryId will always revert

Description

  • Players join by calling joinEvent(uint256 countryId). However, the array teams is limited to 48 items

  • There are more than 48 countries, so it is possible that a player will not have a countryId to join.

// Root cause in the codebase with @> marks to highlight the relevant section

Risk

Likelihood:

  • Highly likely that a player is not from the list of 48 countries

Impact:

  • The affected players calling joinEvent(uint256 countryId) will always revert

Proof of Concept

Copy and paste to briVault.t.sol

PoC to demo what countryId a player might use (e.g. 48) for the joinEvent() call if they don't see their country listed.

function test_revertsIfPlayerNotFromThe48Countries() public {
// User deposit
vm.startPrank(user1);
mockToken.approve(address(briVault), 5 ether);
briVault.deposit(5 ether, user1);
​
// User not from the 48 countries will revert
vm.expectRevert(abi.encodeWithSignature("invalidCountry()"));
briVault.joinEvent(48);
vm.stopPrank();
}

Recommended Mitigation

One possible solution is to have a "catch all" team, so that players not from the listed country can participate.

string[48] countries = [
"United States", "Canada", "Mexico", "Argentina", "Brazil", "Ecuador",
"Uruguay", "Colombia", "Peru", "Chile", "Japan", "South Korea",
"Australia", "Iran", "Saudi Arabia", "Qatar", "Uzbekistan", "Jordan",
"France", "Germany", "Spain", "Portugal", "England", "Netherlands",
"Italy", "Croatia", "Belgium", "Switzerland", "Denmark", "Poland",
"Serbia", "Sweden", "Austria", "Morocco", "Senegal", "Nigeria",
"Cameroon", "Egypt", "South Africa", "Ghana", "Algeria", "Tunisia",
+ "Ivory Coast", "New Zealand", "Costa Rica", "Panama", "United Arab Emirates", "Catch all"
- "Ivory Coast", "New Zealand", "Costa Rica", "Panama", "United Arab Emirates", "Iraq"
];
Updates

Appeal created

bube Lead Judge 19 days ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!