Wenwin contest - Dug's results

Lines of code

https://github.com/code-423n4/2023-03-wenwin/blob/91b89482aaedf8b8feb73c771d11c257eed997e8/src/Lottery.sol#L259-L269

Vulnerability details

Impact

An unclaimed, winning ticket could be listed for sale on a peer to peer NFT exchange by a nefarious actor who then watches the mempool for a purchase/transfer.

Upon seeing that the NFT was purchased, they could frontrun the transaction with a call to claimRewards, receiving the rewards ahead of transferring the now claimed NFT to the recipient.

Proof of Concept

It is just calling an existing claimRewards function, which calls claimWinningTicket, rewarding the owner and marking it as claimed.

    function claimRewards(LotteryRewardType rewardType) external override returns (uint256 claimedAmount) {
        address beneficiary = (rewardType == LotteryRewardType.FRONTEND) ? msg.sender : stakingRewardRecipient;
        claimedAmount = LotteryMath.calculateRewards(ticketPrice, dueTicketsSoldAndReset(beneficiary), rewardType);

        emit ClaimedRewards(beneficiary, claimedAmount, rewardType);
        rewardToken.safeTransfer(beneficiary, claimedAmount);
    }

    function claimWinningTicket(uint256 ticketId) private onlyTicketOwner(ticketId) returns (uint256 claimedAmount) {
        uint256 winTier;
        (claimedAmount, winTier) = this.claimable(ticketId);
        if (claimedAmount == 0) {
            revert NothingToClaim(ticketId);
        }

        unclaimedCount[ticketsInfo[ticketId].drawId][ticketsInfo[ticketId].combination]--;
        markAsClaimed(ticketId);
        emit ClaimedTicket(msg.sender, ticketId, claimedAmount);
    }

Tools Used

Manual review

Recommended Mitigation Steps

Burn tickets when claimed.