BriVault
First Flight #52
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: low
Invalid

Missing Minimum Amount Validation

drmanhattan852

[L-4] Missing Minimum Amount Validation

Description

The contract accepts any value for minimumAmount in the constructor without validation against a maximum limit. This could allow setting an excessively high minimum entry barrier.

constructor (IERC20 _asset, uint256 _participationFeeBsp, uint256 _eventStartDate, address _participationFeeAddress, uint256 _minimumAmount, uint256 _eventEndDate) ERC4626 (_asset) ERC20("BriTechLabs", "BTT") Ownable(msg.sender) {
// No validation for minimumAmount
minimumAmount = _minimumAmount;
// ...
}

Risk

Likelihood:

  • Unrestricted minimumAmount accepts arbitrarily large values during contract deployment

  • No bounds checking creates permanent barrier once contract is deployed

Impact:

  • Excessive minimum deposit threshold prevents regular user participation

  • Enables deployment of effectively private/closed betting pools disguised as public ones

Proof of Concept

Deploy contract with minimumAmount=1000000 ether, creating a tournament that appears public but limits participation to only select wealthy addresses who know the extreme threshold.

// Deploy with extremely high minimum
BriVault vault = new BriVault(
asset,
100, // fee
startDate,
feeAddress,
1000000 ether, // extremely high minimum amount
endDate
);
​
// Result: Most users will be unable to join the event

Recommended Mitigation

Implement MAX_MINIMUM_AMOUNT constant (e.g., 1000 ether) and add constructor validation requiring _minimumAmount <= MAX_MINIMUM_AMOUNT.

// Add constant for maximum minimum amount depending on asset
uint256 constant MAX_MINIMUM_AMOUNT = 1000 ether;
​
constructor (IERC20 _asset, uint256 _participationFeeBsp, uint256 _eventStartDate, address _participationFeeAddress, uint256 _minimumAmount, uint256 _eventEndDate) ERC4626 (_asset) ERC20("BriTechLabs", "BTT") Ownable(msg.sender) {
// ...
require(_minimumAmount <= MAX_MINIMUM_AMOUNT, "Minimum amount too high");
minimumAmount = _minimumAmount;
// ...
}
Updates

Appeal created

bube Lead Judge 19 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Missing Constructor Validation

This is owner action and the owner is assumed to be trusted and to provide correct input arguments.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!