H-08 MitigationConfirmed

Lines of code Vulnerability details Original Issue H-08 - Increasing reserves breaks PrizePool accounting Details The previous implementation to increase reserves in the PrizePool contract didn't take into account the injected reserves, which caused the accounted balance in the prize pool to not ...

VaultBoosterFactory allows deployment of VaultBooster with phoney PrizePool

Lines of code Vulnerability details Impact A malicious VaultBooster can be deployed via VaultBoosterFactory contract. Users may lose funds while interacting with such VaultBooster. File: src/VaultBoosterFactory.sol function createVaultBoosterPrizePool prizePool, address vault, address owner...

_totalWithdrawn VALUE DOES NOT INCLUDE THE _fee AMOUNT THUS INTRODUCING ACCOUNTING ERROR

Lines of code Vulnerability details Impact In the PrizePool.ClaimPrize function is used to claim the rewards of the verified winner. Here when sending the Prize amount to the winner a fee amount is deducted from it as shown below: uint256 amount = tierLiquidity.prizeSize - fee; And this amount is...

Possible centralization issue in PrizePool.closeDraw

Lines of code Vulnerability details The winning random number is chosen by DrawManager, which will lead to centralization risk. Despite haventt really deep dive in codebase of this issue, but if DrawManager ,can somehow calculate which random number can make their controlled address is winner wit...

Using transferFrom on ERC721 tokens

Handle shw Vulnerability details Editing on a previous submission to correct the details Impact In the function awardExternalERC721 of contract PrizePool, when awarding external ERC721 tokens to the winner, the transferFrom function is called instead of safeTransferFrom. If the winner is a contra...

withdraw timelock can be circumvented

Handle cmichel Vulnerability details One can withdraw the entire PrizePool deposit by circumventing the timelock. Assume the user has no credits for ease of computation: user calls withdrawWithTimelockFromuser, amount=userBalance with their entire balance. This "mints" an equivalent amount of...

Awarding takes reserve fee several times

Handle cmichel Vulnerability details The PrizePool.captureAwardBalance function takes fees repeatedly on the same interest. One would expect unaccountedPrizeBalance to be 0 in any repeated calls, but it's not. Assume the following example scenario with a 10% reserve fee: user calls...