Closed code423n4 closed 1 year ago
thereksfour marked the issue as primary issue
"This means ticketsSoldDuringDraw
accounts for tickets sold during the draw N, not for it."
Note the "during" in the variable name. I think this is indeed the intention, that players are referred to the lottery (a ticket purchase) rather than to specific draws.
TutaRicky marked the issue as sponsor disputed
Warden didn't understand referral requirement calculation
thereksfour marked the issue as unsatisfactory: Invalid
Lines of code
https://github.com/code-423n4/2023-03-wenwin/blob/91b89482aaedf8b8feb73c771d11c257eed997e8/src/Lottery.sol#L230
Vulnerability details
As per the docs:
The minimum referral requirement for a draw N + 1 is computed based on the number of tickets sold for the draw N.
In the code, this is computed upon draw execution of the draw N. In
receiveRandomNumber()
:The number used as "number of tickets sold for the draw N" is
ticketsSoldDuringDraw
. It is computed asnextTicketId - lastDrawFinalTicketId
.The issue is that
nextTicketId
is the id of the lastTicket
minted. But tickets are minted for every draw, and ticketId is incremented onmint()
, regardless of thedrawId
This means
ticketsSoldDuringDraw
accounts for tickets sold during the draw N, not for it.Impact
The minimum referral requirement maths is completely broken, and will lead to a potential loss of rewards for referrers.
Proof of Concept
let us look at a draw N. Before execution,
lastDrawFinalTicketId == X
. Execution now happens. Between the last draw execution and this one, there was a specifically high number of ticket sales, for draws ranging from N to M: assume 5,000 were sold for draw N, but 50,000 were sold in total.ticketsSoldDuringDraw = nextTicketId - lastDrawFinalTicketId = 50,000
The minimum referral amount is computed:
Because 50,000 tickets were sold, the minimum number of referrals for draw N + 1 will be 0,75% 50,000 = 375, while it should have been 5,000 1% = 50. Referrers for draw N + 1 will need to find 325 more referrers than what they should.
Some referrers will lose on the reward they were entitled to (if their referral amount is between 50 and 375).
Tools Used
Manual Analysis
Recommended Mitigation Steps
Use a mapping for
nextTicketId
inTicket
, so that it accounts for thedrawId