Forgeries contest - kaliberpoziomka8552's results

A protocol for on-chain games with NFT prizes on Ethereum.

General Information

Platform: Code4rena

Start Date: 13/12/2022

Pot Size: $36,500 USDC

Total HM: 5

Participants: 77

Period: 3 days

Judge: gzeon

Total Solo HM: 1

Id: 191

League: ETH

Forgeries

Findings Distribution

Researcher Performance

Rank: 24/77

Findings: 1

Award: $110.27

🌟 Selected for report: 0

🚀 Solo Findings: 0

Findings Information

Labels

bug
2 (Med Risk)
satisfactory
duplicate-273

Awards

110.2711 USDC - $110.27

External Links

Lines of code

https://github.com/code-423n4/2022-12-forgeries/blob/fc271cf20c05ce857d967728edfb368c58881d85/src/VRFNFTRandomDraw.sol#L33

Vulnerability details

Impact

Incorrect value of immutable state variable MONTH_IN_SECONDS may lead to misconfiguration of drawing and setting values of drawBufferTime and recoverTimeLock much higher than month or year, respectively.

Proof of Concept

The constant MONTH_IN_SECONDS should hold the value of seconds in one month, however, the value that is set: (3600 * 24 * 7) * 30 is equal to 30 weeks, which is around 7 months.

Tools Used

Manual review.

Set the value of MONTH_IN_SECONDS to 3600 * 24 * 30

#0 - c4-judge

2022-12-17T12:53:31Z

gzeon-c4 marked the issue as duplicate of #273

#1 - c4-judge

2022-12-17T12:53:58Z

gzeon-c4 marked the issue as satisfactory

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter