BriVault
First Flight #52
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: medium
Invalid

Missing bounds & empty-team checks

jufel

Description:

  • getCountry(uint256 countryId) accesses teams[countryId] before validating the index range; calling with countryId >= 48 reverts due to out‑of‑bounds before the intended invalidCountry() check.

  • joinEvent() allows choosing an index where teams[countryId] is the empty string; setWinner() can also set a winner to an empty slot. This can make withdrawals impossible for everyone who didn’t join that empty slot.

Impact:

  • Unexpected reverts and unwinnable tournaments.

Proof of Concept:
Add test to 'briVault.t.sol':

function test_WrongCountry() public {
vm.prank(owner);
briVault.setCountry(countries);
​
vm.prank(user1);
briVault.getCountry(50); // out of bounds
vm.expectRevert(abi.encodeWithSignature("eventStarted()"));
// gets [FAIL: panic: array out-of-bounds access]
}

Mitigation:

function getCountry(uint256 countryId) external view returns (string memory) {
- if (bytes(teams[countryId]).length == 0) {
+ if (countryId >= teams.length) {
revert invalidCountry();
}
​
return teams[countryId];
}
Updates

Appeal created

bube Lead Judge 20 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!