sechub
HomeServicesAssetsJobsFindingsTicketsGovCheck
Guest Mode. Click here to sign in and access all features

    Impacted time view accumulator incorrectly managed

    Blast the balloon SC Audit

    Severity
    Low
    Status
    Fixed
    Location(s)

    BTB.sol#L583

    BTB.sol#L591

    BTB.sol#L599

    Description

    When a spin is bought and played, depending on certain probabilities, the duration of the current round may increase or decrease.

    A variable, impactedTime, was created to track the time that has increased or decreased. This variable however is increased and decreased incorrectly due to how max round time, or 0 duration time for current round, are taken into account.

    When a round duration is increased, a check is done to ensure that the new time is capped to max round time (the first line in the next snippet)

        roundInfo.duration = roundInfo.duration + firstLevelImpact >= roundInfo.maxTime ? roundInfo.maxTime : roundInfo.duration + firstLevelImpact;
        impactedTime = impactedTime + firstLevelImpact >= roundInfo.maxTime ? roundInfo.maxTime : impactedTime + firstLevelImpact;
    

    In the case where the increase would of capped max round time, impactedTime should of increased with just the difference between roundInfo.maxTime and impactedTime + firstLevelImpact.

    Capping the impactedTime variable does not have sense, as a round can have multiple duration decrements and increments which should be reflected. The cap is already applied to the duration time itself and only changes to that duration must be reflected in the impacted time.

    Likewise, when a round duration is decreased, the impact time is reduced by the full impact time deduction on duration, not on the actual deduction that has happened. Example if duration is 100 and impact deduction is 150, then only 100 seconds should be deduced from impactedTime

    impactedTime also seems to be intended to be viewed per round (since it is limited to the max round time) but the variable is never cleared on new round start, leaving it with the ending value of the previous round.

    Recommendation

    When increasing or decreasing the impactedTime, only do so with the amount that actually is added/deducted to the original round duration. If the value is to be per round, reset it after creating a new round, otherwise do not cap it.

    Comments
    No comments yet

    Impacted time view accumulator incorrectly managed

    Blast the balloon SC Audit

    Severity
    Low
    Status
    Fixed