search

code-423n4 / 2023-08-pooltogether-mitigation-findings

0 stars 0 forks source link

H-08 MitigationConfirmed #34

Open code423n4 opened 1 year ago

code423n4 commented 1 year ago

Lines of code

Vulnerability details

Issue mitigated

About the problem

PrizePool.increaseReserve function doesn't track funds that were sent as prize token balance. This allows anyone who will call contributePrizeTokens function to steal those tokens and use to increase own chances to win.

Solution

This was solved by tracking contributed amount in the _accountedBalance function. All contributed balance is now accumulated in the directlyContributedReserve variable.

c4-judge commented 1 year ago

Picodes marked the issue as satisfactory