First Flight #13: Baba Marta
First Flight #13
Beginner FriendlyFoundryGameFi
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

`MartenitsaEvent::_participants` mapping is not cleared in `MartenitsaEvent::stopEvent` function which means user can only join one event and not next events in future.

mirkopezo

Summary

When user joins event, he will not be able to join next event in future.

Vulnerability Details

There will be multiple events and user will be only able to join one event. There is no documentation or natspec which explains this behavior, from security standpoint it should be assumed that it is vulnerability.

function stopEvent() external onlyOwner {
require(block.timestamp >= eventEndTime, "Event is not ended");
for (uint256 i = 0; i < participants.length; i++) {
isProducer[participants[i]] = false;
}
@> // @audit - _participants mapping is not cleared
}

Impact

User can join only one event, it will not be able to joint other events in future.

Proof of Concept

This is existing test from MartenitsaEvent.t.sol. From looking this test it seems that this is desired and not vulnerability, but developer could make mistake to expect that second time joining event will revert but it shouldn't revert.

function testStopEvent() public eligibleForReward {
martenitsaEvent.startEvent(1 days);
vm.startPrank(bob);
marketplace.collectReward();
healthToken.approve(address(martenitsaEvent), 10 ** 18);
​
martenitsaEvent.joinEvent();
vm.warp(block.timestamp + 1 days + 1);
vm.stopPrank();
martenitsaEvent.stopEvent();
assert(martenitsaEvent.isProducer(bob) == false);
}

Tools Used

Manual review

Recommendations

If behavior that user can enter event only once is desired behavior, document it properly.

If it is not desired behavior, think of way to achieve that participants are cleared when stopping event, this is just broad suggestion because if not done correctly it may introduce new vulnerability.

Updates

Lead Judging Commences

bube Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

_participants is not updated

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.