Submission Details
Impact:
Likelihood:
## L-1 — `players`/`rewards` length mismatch is unvalidated
Root + Impact
The constructor loop indexes i_rewards[i] up to i_players.length with no length-equality check.
Description
// src/Pot.sol
for (uint256 i = 0; i < i_players.length; i++) {
playersToRewards[i_players[i]] = i_rewards[i]; // @> assumes i_rewards.length >= i_players.length
}
// src/ContestManager.sol
function createContest(address[] memory players, uint256[] memory rewards, ...) { // @> no length check
Risk
Likelihood: Mismatched array lengths supplied by the owner.
Impact: Deployment revert (short rewards) or silent under-allocation (long rewards).
Proof of Concept
// test/Exploits.t.sol
function testArrayLengthMismatchReverts() public {
address[] memory p = _players2();
uint256[] memory r = new uint256[](1);
r[0] = 100e18;
vm.prank(owner);
vm.expectRevert();
manager.createContest(p, r, IERC20(address(token)), 100e18);
}
Recommended Mitigation
+ require(players.length == rewards.length, "length mismatch");
Pot pot = new Pot(players, rewards, token, totalRewards);
Rewards breakdown
This contest has a flat reward structure with the following payouts:
Live
The contest is live. Earn rewards by submitting a finding.
Judging
Submissions are being reviewed by our AI judge. Results will be available in a few minutes.
View all submissionsRewards Distribution
The contest is complete and the rewards are being distributed.