Submission Details
Impact:
Likelihood:
Missing Verification of Treasure Count Bounds
Author Revealed upon completion
Root + Impact
Description
The contract tracks
claimsCountbut does not validate upfront whether remaining treasures are actually claimable or distinct before incrementing.
// Root cause in TreasureHunt.sol
// @> No check tying treasureHash to allowed set
_incrementClaimsCount();
Risk
Likelihood:
-
Happens during normal claim flows.
Allows claimsCount to be artificially inflated without valid distinct treasure claims.
Impact:
Exhausts the
claimsCountlimit, locking out legitimate hunters.
Proof of Concept
for (i = 0; i < MAX_TREASURES; i++) {
claim(fakeProof, someHash, attacker);
}
// claimsCount becomes MAX_TREASURES, blocking future claims
Recommended Mitigation
Ensure that proof maps to distinct treasures chosen at deployment.
- remove this code
+ add this code
+require(validTreasures[treasureHash], "Invalid treasure");
Rewards breakdown
nSLOC
220This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.
Rewards Distribution
The contest is complete and the rewards are being distributed.