F-2025-0018·logic-error

Distribution of NXL failing during round settlement will not deactivate the product, resulting in a new raffle with new rewards available

Fixedrafflelotteryvrf
TL;DR

_distributeRound calls nxlToken.distributeReward directly via try/catch, swallowing exhaustion failures and leaving the product active for a new round with no NXL available.

Severity
MEDIUM
Impact
MEDIUM
Likelihood
MEDIUM
Method
MManual review
CAT.
Complexity
MEDIUM
Exploitability
MEDIUM
02Section · Description

Description

The _distributeRound function distributes the NXL winner bonus by calling nxlToken.distributeReward(winner, product.nxlWinnerBonus) directly instead of using the _distributeNXL helper, which encapsulates the exhaustion handling logic for the NXL token supply.

When distributeReward fails because the NXL reward supply is exhausted, the try/catch in _distributeRound simply ignores the failure and does not trigger _handleNXLExhaustion, so products[productId].active remains true and the product is not deactivated.

Vulnerable Scenario:

The following steps help understand the issue:

  1. The last ticket of a raffle is bought and rewards distribution occurs normally
  2. The winner is selected, but there isn't enough NXL rewards for them
  3. nxlToken.distributeReward fails silently, and the product remains active
  4. A new rounds is started, without NXL available anymore
03Section · Recommendation

Recommendation

Replace the direct try nxlToken.distributeReward(winner, product.nxlWinnerBonus) {} catch {} call in _distributeRound with a call to _distributeNXL(winner, product.nxlWinnerBonus, productId) so that exhaustion of NXL rewards always triggers _handleNXLExhaustion and deactivates the product as intended.

At the end of NexumManager::_distributeRound:

diff
- try nxlToken.distributeReward(winner, product.nxlWinnerBonus) {} catch {}
+ _distributeNXL(winner, product.nxlWinnerBonus, productId);
04Section · Resolution

Resolution

Nexalo: Fixed.

Zealynx: Verified. Fixed.

Status
Fixed
F-2025-0018

oog
zealynx

Smart Contract Security Digest

Monthly exploit breakdowns, audit checklists, and DeFi security research — straight to your inbox

© 2026 Zealynx