c4-bot-5 commented 8 months ago

Lines of code

https://github.com/code-423n4/2023-12-revolutionprotocol/blob/main/packages/revolution/src/CultureIndex.sol#L529

Vulnerability details

Impact

Detailed description of the impact of this finding. wrong implementation of maxHeap.extractMax(); as it should return values but here its not assigned to anything.

Proof of Concept

Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept.

maxHeap.extractMax();

in Maxheap.sol we have define : function extractMax() external onlyAdmin returns (uint256, uint256) { require(size > 0, "Heap is empty");

    uint256 popped = heap[0];
    heap[0] = heap[--size];
    maxHeapify(0);

    return (popped, valueMapping[popped]);
}

so it should be some return value.

Tools Used

Manual Analysis

Recommended Mitigation Steps

(uint256, uint256)=maxHeap.extractMax();

Assessed type

Context

c4-pre-sort commented 8 months ago

raymondfam marked the issue as insufficient quality report

c4-pre-sort commented 8 months ago

raymondfam marked the issue as primary issue

raymondfam commented 8 months ago

Inadequate proof.

c4-judge commented 8 months ago

MarioPoneder marked the issue as unsatisfactory: Insufficient quality

code-423n4 / 2023-12-revolutionprotocol-findings

wrong implementation of maxHeap.extractMax(); #711