BriVault
First Flight #52
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: medium
Invalid

setCountry() Can Be Called After Deposits Made

jufel

Description:

The setCountry() function has no time restrictions and can be called by the owner at any time, even after users have deposited and joined teams. This allows the owner to change team names after users have made their bets, potentially causing confusion or malicious manipulation.

Impact:

  • Owner can change team names after users bet

  • Users' bets reference changed team names

  • Potential for confusion or manipulation

  • Trust in contract diminished

Proof of Concept:

function testOwnerCanChangeTeamsAfterBetting() public {
// User deposits and joins team 0
vm.startPrank(attacker);
asset.approve(address(vault), 10000 * 10**18);
vault.deposit(10000 * 10**18, attacker);
vault.joinEvent(0);
string memory originalTeam = vault.userToCountry(attacker);
vm.stopPrank();
​
// Owner changes team names
string[48] memory newTeams;
for(uint i = 0; i < 48; i++) {
newTeams[i] = string(abi.encodePacked("NewTeam", vm.toString(i)));
}
vault.setCountry(newTeams);
​
// User's bet now references different team name
string memory newTeamName = vault.getCountry(0);
assertFalse(
keccak256(bytes(originalTeam)) == keccak256(bytes(newTeamName)),
"Team changed after user bet"
);
}

Mitigation:

Add a flag to prevent changing teams after they're set, or add time restriction:

bool public teamsFinalized;
​
function setCountry(string[48] memory countries) public onlyOwner {
require(!teamsFinalized, "Teams already finalized");
require(numberOfParticipants == 0, "Cannot change after deposits");
​
for (uint256 i = 0; i < countries.length; ++i) {
teams[i] = countries[i];
}
teamsFinalized = true;
emit CountriesSet(countries);
}
Updates

Appeal created

bube Lead Judge 19 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

setCountry() Can Be Called After Users Join

This is owner action.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!