sechub
HomeServicesAssetsJobsFindingsTicketsGovCheck
Guest Mode. Click here to sign in and access all features

    Incorrect balance availability check when claiming prizes

    Blast the balloon SC Audit

    Severity
    Low
    Status
    Fixed
    Location(s)

    BTB.sol#L515

    Description

    A user can claim his prizes by calling the claimPrize function. Within this function, there is a check that there are enough funds in the contract for the rewards to be given out. This is done for better error handing on the dapp and improving gas consumption.

        require(address(this).balance >= claimableAmounts[_msgSender()], BlastTheBalloonErrors.NOT_ENOUGH_TOKEN);
    

    This check is however incorrect in the case where there are also pending rewards to be claimed

            uint allPrize = claimableAmounts[_msgSender()] + pendingAmount;
            // ... code ...
            (bool success, ) = payable(_msgSender()).call{value: allPrize}("");
    

    If the addition of pending rewards is more then the balance, the operations will revert further in the execution.

    Recommendation

    Move the declaration and initialization of the allPrize variable before the balance check and compare this value against the contract balance instead of only the claimableAmounts.

    Comments
    No comments yet

    Incorrect balance availability check when claiming prizes

    Blast the balloon SC Audit

    Severity
    Low
    Status
    Fixed