Platform: Code4rena
Start Date: 07/07/2023
Pot Size: $121,650 USDC
Total HM: 36
Participants: 111
Period: 7 days
Judge: Picodes
Total Solo HM: 13
Id: 258
League: ETH
Rank: 33/111
Findings: 1
Award: $569.07
🌟 Selected for report: 0
🚀 Solo Findings: 0
🌟 Selected for report: rvierdiiev
Also found by: MiniGlome
569.0704 USDC - $569.07
##Impact A malicious user is able to claim the prizes without having to compete in the bot race
##Proof of concept
When claimPrizes() is called to claim the prizes on behalf of the users, it is possible to frontrun this call and get the claiming reward by replacing the _feeRecipient address.
##Recommended Mitigation Steps The protocol should implement an anti-frontrunning strategy such as the LibSubmarine (https://libsubmarine.org/)
Timing
#0 - c4-judge
2023-07-18T17:46:13Z
Picodes marked the issue as unsatisfactory: Invalid
#1 - c4-judge
2023-08-08T13:13:56Z
Picodes marked the issue as satisfactory
#2 - c4-judge
2023-08-08T13:14:36Z
Picodes marked the issue as duplicate of #115