First Flight #13: Baba Marta
First Flight #13
Beginner FriendlyFoundryGameFi
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

You cannot join a second event in `MartenitsaEvent.sol::joinEvent` because the `_participants` mapping is never reset

coffee

Summary

You cannot join a second event in MartenitsaEvent.sol::joinEvent because the _participants mapping is never reset from the previous events.

Vulnerability Details

Users that entered a previous event can never join another one even if they meet all of the criteria:

  1. The event started

  2. They are not a Producer

  3. They have sufficient HealthToken balance

This is because the _participants mapping is never reset, the contract still considers them to be part of the current event even though they are not actually part of it.

Impact

The test below passes showing that someone who joins an event can never join another one even if they meet all of the required criteria.

modifier eligibleForTwoRewards() {
vm.startPrank(chasy);
martenitsaToken.createMartenitsa("bracelet");
martenitsaToken.createMartenitsa("bracelet");
martenitsaToken.createMartenitsa("bracelet");
martenitsaToken.createMartenitsa("bracelet");
martenitsaToken.createMartenitsa("bracelet");
martenitsaToken.createMartenitsa("bracelet");
marketplace.listMartenitsaForSale(0, 1 wei);
marketplace.listMartenitsaForSale(1, 1 wei);
marketplace.listMartenitsaForSale(2, 1 wei);
marketplace.listMartenitsaForSale(3, 1 wei);
marketplace.listMartenitsaForSale(4, 1 wei);
marketplace.listMartenitsaForSale(5, 1 wei);
martenitsaToken.approve(address(marketplace), 0);
martenitsaToken.approve(address(marketplace), 1);
martenitsaToken.approve(address(marketplace), 2);
martenitsaToken.approve(address(marketplace), 3);
martenitsaToken.approve(address(marketplace), 4);
martenitsaToken.approve(address(marketplace), 5);
marketplace.makePresent(bob, 0);
marketplace.makePresent(bob, 1);
marketplace.makePresent(bob, 2);
marketplace.makePresent(bob, 3);
marketplace.makePresent(bob, 4);
marketplace.makePresent(bob, 5);
vm.stopPrank();
_;
}
​
function testCannotJoinAnotherEvent() public eligibleForTwoRewards {
martenitsaEvent.startEvent(1 days);
vm.startPrank(bob);
marketplace.collectReward();
healthToken.approve(address(martenitsaEvent), 10 ** 18);
martenitsaEvent.joinEvent();
vm.warp(block.timestamp + 1 days + 1);
vm.stopPrank();
martenitsaEvent.stopEvent();
assert(martenitsaEvent.isProducer(bob) == false);
​
martenitsaEvent.startEvent(1 days);
​
vm.startPrank(bob);
marketplace.collectReward();
​
vm.expectRevert();
martenitsaEvent.joinEvent();
vm.stopPrank();
assert(healthToken.balanceOf(bob) == 10 ** 18);
}

Tools Used

--Foundry

Recommendations

It is recommended to reset the _participants mapping after an event ends.

function stopEvent() external onlyOwner {
require(block.timestamp >= eventEndTime, "Event is not ended");
for (uint256 i = 0; i < participants.length; i++) {
isProducer[participants[i]] = false;
+ delete _participants[participants[i]];
}
}
Updates

Lead Judging Commences

bube Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

_participants is not updated

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.