code423n4 commented 1 year ago

Lines of code

https://github.com/code-423n4/2023-01-drips/blob/9fd776b50f4be23ca038b1d0426e63a69c7a511d/src/Drips.sol#L492

Vulnerability details

Code breaks if first user is not expected user

Summary

Rather than iterate and continue if user is not the expected one, this code breaks all the execution if first user is userId

Vulnerability Detail

Execution is broke most of the times at first iteration

for (; idx < receivers.length; idx++) {
    DripsReceiver memory receiver = receivers[idx];
    if (receiver.userId != userId) break;
    (uint32 start, uint32 end) =
        _dripsRange(receiver, updateTime, maxEnd, squeezeStartCap, squeezeEndCap);
    amt += _drippedAmt(receiver.config.amtPerSec(), start, end);
}

Impact

Code not working if first user is not expected one

Code Snippet

Drips.sol#L492 if (receiver.userId != userId) break;

Tool used

Manual Review

Recommendation

Use continue rather than break

for (; idx < receivers.length; idx++) {
    DripsReceiver memory receiver = receivers[idx];
-    if (receiver.userId != userId) break;
+    if (receiver.userId != userId) continue;
    (uint32 start, uint32 end) =
        _dripsRange(receiver, updateTime, maxEnd, squeezeStartCap, squeezeEndCap);
    amt += _drippedAmt(receiver.config.amtPerSec(), start, end);
}

c4-judge commented 1 year ago

GalloDaSballo marked the issue as duplicate of #71