mediumLogic errorEVM-Solidity
Thruster: `claimPrizesForRound` transfers the entire amount deposited for a prize regardless of the number of winners
- Payout
- $0
- Protocol
- Thruster
- Disclosed
- Mar 28, 2024
- Source
- code4rena
ThrusterTreasure's claim path pays out the entire prize recorded by setPrize() to the first qualifying caller instead of splitting it across the configured winner count. Because _claimPrize unconditionally transfers the full stored WETH/USDB amounts, the first …
Similar reports
- No close matches yet.
References
- https://github.com/code-423n4/2024-02-thruster-findings/issues/27
- https://github.com/code-423n4/2024-02-thruster-findings
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.