Lucene search
+L

2 matches found

Code423n4
Code423n4
added 2023/03/09 12:0 a.m.14 views

No sanity check on drawCoolDownPeriod can lead to frontrun attacks on jackpot prize

Lines of code Vulnerability details Impact During the construction of the LotterySetup, there is no sanity check on drawCoolDownPeriod. If its set to zero, then there will be no cool down period, players can buy the lottery tickets at any time until the draw. Once lottery setup is complete with...

6.7AI score
SaveExploits0
Code423n4
Code423n4
added 2023/03/09 12:0 a.m.17 views

Validator/miner can set Block timestamp to a draw scheduled date and buy winning ticket if drawCoolDownPeriod is set to zero

Lines of code Vulnerability details Impact Validators/Miners would always be able to get the Jackpot prize, compromising the protocol. Proof of Concept The following foundry test illustrates this behaviour. Essentially, if the cooldown period time before a draw during which it is not possible to...

6.7AI score
SaveExploits0
Rows per page
Query Builder