New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

claimExact() Missing Validation As In claim() #194

Open

code423n4 opened this issue Nov 10, 2021 · 2 comments

Labels

0 (Non-critical) bug sponsor acknowledged

Contributor

code423n4 commented Nov 10, 2021

Handle

Meta0xNull

Vulnerability details

Impact

claim() and claimExact() Both Should Have Same Verification Requirements. But claimExact() Missing Validation Code as claim() in Line 524.

Code: require(validated[msg.sender] == 1, "Address not validated to claim.");

Proof of Concept

https://github.com/code-423n4/2021-11-bootfinance/blob/main/vesting/contracts/AirdropDistribution.sol#L524

Tools Used

Manual Review

Recommended

Insert Missing Validation Code Between Line 552 and 553 for claimExact()

https://github.com/code-423n4/2021-11-bootfinance/blob/main/vesting/contracts/AirdropDistribution.sol#L552-L553

code423n4 added 1 (Low Risk) bug labels

code423n4 added a commit that referenced this issue


          Meta0xNull issue #194

8230e27

chickenpie347 added the sponsor acknowledged label

Collaborator

chickenpie347 commented Jan 3, 2022

The check at claimexact require(airdrop[msg.sender].amount != 0); removes the need for the validation.

chickenpie347 mentioned this issue

claimExact does not check it user is validated #268

Closed

Collaborator

0xean commented Jan 8, 2022

I believe the sponsor is correct here, but would be good to standardize these checks across the functions to avoid confusion. Downgrading to 0 - Non Critical as a clarity issue.

CloudEllie added 0 (Non-critical) and removed 1 (Low Risk) labels

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment