First Flight #13: Baba Marta
First Flight #13
Beginner FriendlyFoundryGameFi
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

`stopEvent` function is not updating the `_participants` mapping which is causing the `getParticipants` function to return incorrect data and also interfering with the upcoming events.

naman1729

Summary

  • stopEvent function is not updating the _participants mapping which is causing the getParticipants function to return incorrect data and also interfering with the upcoming events.

Vulnerability Details

  • if a user is participating in the first event. then the user can't able to participate in the upcoming events because the stopEvent function is not updating the _participants mapping.

  • After calling the stopEvent function, the user can't get the correct data of the participants

function stopEvent() external onlyOwner {
require(block.timestamp >= eventEndTime, "Event is not ended");
for (uint256 i = 0; i < participants.length; i++) {
isProducer[participants[i]] = false;
@> }
}

POC

  • put this test in MartenitsaEvent.t.sol

function testStopEvent() public eligibleForReward {
martenitsaEvent.startEvent(1 days);
vm.startPrank(bob);
marketplace.collectReward();
healthToken.approve(address(martenitsaEvent), 10 ** 18);
martenitsaEvent.joinEvent();
vm.warp(block.timestamp + 1 days + 1);
vm.stopPrank();
martenitsaEvent.stopEvent();
assert(martenitsaEvent.isProducer(bob) == false);
assert(martenitsaEvent.getParticipant(bob) == true);
}

  • Run test by using the following command

forge test --mt testStopEvent -vvvv

Impact

  • A user can't able to participate in the upcoming events

  • A user can't get the correct data of the participants

Tools Used

  • Manual review

Recommendations

  • Update this function in MartenitsaEvent.sol contract

function stopEvent() external onlyOwner {
require(block.timestamp >= eventEndTime, "Event is not ended");
for (uint256 i = 0; i < participants.length; i++) {
isProducer[participants[i]] = false;
+ _participants[participants[i]] = false;
}
}
Updates

Lead Judging Commences

bube Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

_participants is not updated

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.