Submitted by hihen, also found by 0xsomeone, 0x52, bin2chen, and AkshaySrivastav
When calling KUMAFeeCollector.changePayees() with duplicate payees in newPayees, the call is not reverted and the result state will be incorrect.
Contract KUMAFeeCollector does not support duplicate payees. The transaction will revert when trying to add duplicate payees in addPayee():
But, function KUMAFeeCollector.changePayees() forgets this constraint, which allows duplicate payees to be passed in newPayees. This will cause the contract to record an incorrect state and not work properly.
For example, if newPayees contains duplicate payee A, all of its shares will be added to _totalShares, but _shares[A] will only record the last one.
As a result, the sum of all recorded _shares will be less than _totalShares.
Test code for PoC:
Outputs:
VS Code
KUMAFeeCollector.changePayees() should revert if there are duplicates in newPayees:
m19 (KUMA) confirmed and commented:
Alex the Entreprenerd (judge) commented:
m19 (KUMA) mitigated:
