Discrepancy between the expected reward and the actual reward due to unclaimed prizes or rollovers

[code423n4]

Lines of code

https://github.com/code-423n4/2023-03-wenwin/blob/main/src/Lottery.sol#L203-L232

Vulnerability details

Impact

If there are unclaimed rewards or rollovers from previous draws, the size of the prize pool available for rewards may be reduced, and this can result in the drawRewardSize() function returning a value that is less than the amount required to pay out all the jackpot winners at the expected amount. In such a case, the jackpot prize would need to be adjusted accordingly to ensure that it is split among the winners fairly. So the jackpot prize needs to be adjusted so that the payouts are fair

Proof of Concept

• prize pool for a particular draw is 1000 tokens
• percentage allocated to rewards is 80% (i.e., 800 tokens) ( if there are no unclaimed rewards or rollovers from previous draws, the drawRewardSize() function would return 800 tokens for that draw)
• 10 jackpot winners are for this draw
• each winner would get 80 tokens BUT if some prizes are unclaimed so prize pool is reduced... AND what we get For example, if there were 2 unclaimed jackpot prizes from a previous draw, and each prize was worth 40 tokens, the total prize pool for the current draw would be reduced to 920 tokens (1000 - 2 * 40). In this case, the drawRewardSize() function would return 736 tokens (i.e., 80% of 920), which is less than the 800 tokens that would be required to pay out 10 jackpot winners at 80 tokens each.

Tools Used

Recommended Mitigation Steps

1) reserve a portion of the prize pool for unclaimed rewards and rollovers 2) additional checks and balances to ensure that the prize pool is always accurately calculated and distributed

[thereksfour]

Seems to be invalid, will check back later

[c4-judge]

thereksfour marked the issue as primary issue

[thereksfour]

In fact unclaimed jackpots are included in the prize pool, while non-jackpots are not, but warden does not point this out, consider QA

[c4-judge]

thereksfour changed the severity to QA (Quality Assurance)

[c4-judge]

thereksfour marked the issue as grade-b

[rand0c0des]

This is not an issue. We cannot return non jackpot rewards if they are not claimed, as we do not know exact number of winners. We use an estimate in form of expectedPayout. (sometimes it will be more sometimes it will be less).

[c4-sponsor]

rand0c0des marked the issue as sponsor disputed

[c4-judge]

thereksfour marked the issue as grade-c