Submitted by pep7siup, also found by anonymousjoe, boredpukar, amaron, shaflow2, and d3e4
The getNextEntropy function can be called at any time without waiting for the write entropy batches process to finish. This could lead to the function returning an uninitialized entropy value of 000000, resulting in users losing funds to mint useless tokens and not being eligible for future airdrops as they get 0 shares. This vulnerability can severely impact the users trust and the protocols functionality.
Found in contracts/EntropyGenerator/EntropyGenerator.sol at Line 103:
Apply following POC via git apply POC.patch and run yarn test. The test confirms getNextEntropy did return entropy 0 instead of revert.
Hardhat
Only allow getNextEntropy call if currentSlotIndex < lastInitializedIndex to ensure that the entropy slots are properly initialized:
Abdessamed (warden) commented:
Koolex (judge) commented:
Abdessamed (warden) commented:
