SNARKeling Treasure Hunt
First Flight #59
Beginner FriendlyGameFiFoundry
100 EXP
View all submissions
Previous Next
Submission Details
Impact: low
Likelihood: high

No Minimum Balance Check in Constructor

Author Revealed upon completion

Missing Minimum Balance Check in constructor which is not following the comments

Description

  • The constructor initializes state variables and ensures that the verifier is not the zero address

  • In the constructor is the following comment, Owner should fund 100 ETH at deployment (10 treasures × 10 ETH). This is however not enforced.

// @> //Owner should fund 100 ETH at deployment (10 treasures × 10 ETH).

Risk

Likelihood:

  • This occurs whenever the contract is being deployed

Impact:

  • The contact can be deployed with 0 ETH since there is no one stopping its deployment.

  • The impact is not very serious since claim() would revert

Proof of Concept

No PoC

Recommended Mitigation

just to be safe and make this good for production, it might be good to add the check in the constructor

​
constructor(address _verifier) payable {
if (_verifier == address(0)) revert InvalidVerifier();
// ← Add this line for minimum balance check
if (msg.value < 100 ether) revert NotEnoughFunds(); // enforces exactly the amount needed for 10 treasures
​
owner = msg.sender;
verifier = IVerifier(_verifier);
paused = false;
}

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!