Submitted by EV_om, also found by 0xDING99YA (1, 2), oakcobalt, and rvierdiiev
The ThrusterTreasure contract is designed to facilitate a lottery game where users can enter tickets to win prizes based on entropy. The contract includes mechanisms for entering tickets into rounds (enterTickets()), setting prizes for rounds (setPrize()), and claiming prizes (claimPrizesForRound()). A critical aspect of the games integrity is ensuring each ticket has an equal chance to win every prize.
However, there is a significant flaw in enterTickets(). The function checks if winning tickets for the prize index 0 have been set by verifying that winningTickets[currentRound_][0].length == 0. This check is intended to prevent users from entering tickets after prizes have begun to be distributed, but it does not account for prizes with higher indices that may already have been distributed. As a result, users can still enter tickets after some prizes have been distributed, but these late-entered tickets will not have a chance to win the already distributed prizes:
ThrusterTreasure.sol#L83-L96
Freeze ticket entry for the current round once any prize has been set.
jooleseth (Thruster) confirmed, but disagreed with severity and commented:
0xleastwood (judge) decreased severity to Low/Non-Critical and commented:
EV_om (warden) commented:
0xleastwood (judge) increased severity to Medium and commented:
