Lines of code
<https://github.com/code-423n4/2023-03-wenwin/blob/91b89482aaedf8b8feb73c771d11c257eed997e8/src/LotteryMath.sol#L35-L56&gt;

Vulnerability details

Impact

The lottery is not sustainable over time. Excess pot calculation may drift, which either leads to insufficient payouts or a depletion of funds.

Proof of Concept

The payouts are calculated using an estimate of the net profit, currentNetProfit. There is limited tolerance for errors in the estimated net profit: if the estimate is too low the lottery will payout too little (leaving funds effectively stuck in the contract), and if it is too high the contract may run out of funds.

currentNetProfit is updated (by calculateNewProfit) each draw by adding an estimate of the payout. The average error in the payout does indeed tend towards zero, but the cumulative error does NOT. The error sources are both the intrinsic randomness as well as unclaimed tickets. This means that currentNetProfit may over time drift arbitrarily far from its true value. There is currently nothing that corrects for this.

Tools Used

Code inspection

Recommended Mitigation Steps

There must be a correction of currentNetProfit towards its true value. Since tickets may remain unclaimed for up to a year it is only possible to directly calculate the net profit until a year in the past. This may be sufficient to contain the drift. Intermediate estimations may also be used, on the assumption that most tickets are claimed much sooner than within a year.

The text was updated successfully, but these errors were encountered:

All reactions