Root + Impact

In the constructor there's no check for mismatch between the length of the players and rewards length. This will break the code execution and the transaction will revert as a non existent part of the memory will be accessed for the shorter array.

Description

• In normal circumstances the length of the players and rewards arrays is the same.

• Different length will break the code execution.

Risk

Likelihood:

• This will occur when the user forgets to provide a reward for every player or when they list too many rewards.

Impact:

• Transaction will revert

Proof of Concept

Calling the constructor with the following parameters will revert:

Recommended Mitigation

It is recommended to add a check for arrays' length mismatch in the constructor.