Submission Details
Impact:
Likelihood:
Constructor Does Not Validate That players.length == rewards.length
Constructor Does Not Validate That players.length == rewards.length
DescriptionNormal behavior
Each player should have exactly one corresponding reward.
For example:
Alice → 100
Bob → 200
Charlie → 300
Therefore:
players.length == rewards.length
must always hold.
Specific issue
The constructor directly accesses:
i_rewards[i]
for every element in i_players.
No length validation exists.
for (uint256 i = 0; i < i_players.length; i++) {
playersToRewards[i_players[i]] = i_rewards[i];
}
Risk
Likelihood:
Invalid input can be supplied by the caller of
createContest().
Impact:
Contest deployment reverts.
Incorrect contest configuration cannot be detected with a clear custom error.
Proof of Concept
function testMismatchedArraysRevert() public {
address[] memory players = new address[](3);
uint256[] memory rewards = new uint256[](2);
// Pot deployment reverts when i == 2.
new Pot(players, rewards, token, 300);
}
Recommended Mitigation
constructor( address[] memory players, uint256[] memory rewards, IERC20 token, uint256 totalRewards ) { + if (players.length != rewards.length) { + revert InvalidArrayLength(); + } ... }
Rewards breakdown
This contest has a flat reward structure with the following payouts:
Live
The contest is live. Earn rewards by submitting a finding.
Judging
Submissions are being reviewed by our AI judge. Results will be available in a few minutes.
View all submissionsRewards Distribution
The contest is complete and the rewards are being distributed.