PoolTogether - LootBox and MultipleWinners Strateg

Off-Chain (Private)

Audited on 2020/10/31

2 active critical issues

Summary

Executive Summary This report presents the results of our engagement with PoolTogether to review the LootBox and MultipleWinners Prize Strategy. The review was conducted by Martin Ortner and Nicholas Ward over the course of nine person-days between November 23rd and November 27th, 2020. Scope Our review focused on the following repositories: Repository Commit# Focus pooltogether-pool-contracts c50de1d7af67a14990543af0c2d2703eca29f0e9 MultipleWinners PrizeStrategy (details see Appendix) loot-box 2cbea5a85d53c555e28791df5b264d7b32779eea LootBox Implementation The list of files in scope can be found in the Appendix.

Project

PoolTogether

Multi-Chain

Issues (23)

	Low	Medium	High	Critical	Total
Not fixed	13	5	3	2	23
Fixed	-	-	-	-	0
Total	13	5	3	2	23

Contracts (5)

#	File Name
1	pool/contracts/prize-strategy/multiple-winners/MultipleWinners.sol
2	pool/contracts/builders/MultipleWinnersBuilder.sol
3	pool/contracts/prize-strategy/multiple-winners/MultipleWinnersProxyFactory.sol
4	pool/contracts/prize-strategy/PeriodicPrizeStrategyListener.sol
5	pool/contracts/prize-strategy/PeriodicPrizeStrategy.sol

#	File Name
1	pool/contracts/prize-strategy/multiple-winners/MultipleWinners.sol
2	pool/contracts/builders/MultipleWinnersBuilder.sol
3	pool/contracts/prize-strategy/multiple-winners/MultipleWinnersProxyFactory.sol
4	pool/contracts/prize-strategy/PeriodicPrizeStrategyListener.sol
5	pool/contracts/prize-strategy/PeriodicPrizeStrategy.sol

PoolTogether - LootBox and MultipleWinners Strateg

Summary

Issues (23)

LootBox - Unprotected selfdestruct in proxy implementationnot_fixed/critical

PeriodicPrizeStrategy - RNG failure can lock user fundsnot_fixed/critical

PeriodicPriceStrategy - trustedForwarder can impersonate any msg.sendernot_fixed/high

Ticket duplicationnot_fixed/high

Unpredictable behavior for users due to admin front running or general bad timingnot_fixed/high

Contracts (5)