Submission Details
Impact:
Likelihood:
Missing array length validation in Pot constructor allows reward mapping corruption
Root + Impact
Missing array length validation in Pot constructor allows reward mapping corruption
Description
The constructor iterates over i_players using its own length, but never validates that i_rewards.length == i_players.length. If fewer rewards are provided than players, the last players silently receive a reward of 0. If more rewards are provided, the excess is ignored.
// Root cause in the codebase with @> marks to highlight the relevant section
@> constructor(address[] memory players, uint256[] memory rewards, IERC20 token, uint256 totalRewards) {
i_players = players;
i_rewards = rewards;
i_token = token;
i_totalRewards = totalRewards;
remainingRewards = totalRewards;
i_deployedAt = block.timestamp;
// i_token.transfer(address(this), i_totalRewards);
for (uint256 i = 0; i < i_players.length; i++) {
playersToRewards[i_players[i]] = i_rewards[i]; // audit-high we dont check the lenght of rewards array what if we got 3 players and 2 rewards
}
}
Risk
Likelihood:
-
The
createContestfunction inContestManageraccepts both arrays from the caller with no validation, making it trivial to pass mismatched arrays -
Any accidental or malicious mismatch between player and reward arrays will deploy a corrupted contract with no revert
Impact:
-
Players can be permanently locked out of their rewards with no way to recover them.
-
The contract deploys successfully with corrupted state and no revert occurs.
Proof of Concept
address[] memory players = new address[](3);
uint256[] memory rewards = new uint256[](2);
// players[2] will have playersToRewards[players[2]] == 0
// They can never claim — no revert, no warning
new Pot(players, rewards, token, totalRewards);
Recommended Mitigation
- remove this code
constructor(address[] memory players, uint256[] memory rewards, IERC20 token, uint256 totalRewards) {
+ require(players.length == rewards.length, "Array length mismatch");
i_players = players;
+ add this code
Rewards breakdown
This contest has a flat reward structure with the following payouts:
Live
The contest is live. Earn rewards by submitting a finding.
Judging
Submissions are being reviewed by our AI judge. Results will be available in a few minutes.
View all submissionsRewards Distribution
The contest is complete and the rewards are being distributed.