First Flight #13: Baba Marta
First Flight #13
Beginner FriendlyFoundryGameFi
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Participant can not join next event

MrCrowNFT

Summary

User can not join new event after participating in the previous one because _participants mapping is not reseted.

Vulnerability Details

MartenitsaEvent::joinEvent reverts if user was participant in previous event, when stopEvent is called at the end of an event, it sets the producers role back to false, but does not do the same with the participants, as such, they can join next event because joinEvent require !_participants.

##Proof of code
You may add the following code to MartenitsaEvent.t.sol to corroborate the issue:

function testPreviousParticipantsCanNotJoinNextEvent() public activeEvent eligibleForReward{
//Eligible user joins event
vm.startPrank(bob);
marketplace.collectReward();
healthToken.approve(address(martenitsaEvent), 10 ** 18);
martenitsaEvent.joinEvent();
vm.stopPrank();
​
//Event ends
vm.warp(block.timestamp + 1 days + 1);
vm.stopPrank();
martenitsaEvent.stopEvent();
​
//New Events start
martenitsaEvent.startEvent(1 days);
​
//User can not join new event
vm.startPrank(bob);
marketplace.collectReward();
healthToken.approve(address(martenitsaEvent), 10 ** 18);
vm.expectRevert();
martenitsaEvent.joinEvent();
vm.stopPrank();
​
//User is still participant but does not have the producer role
assert(martenitsaEvent.isProducer(bob) == false);
assert(martenitsaEvent.getParticipant(bob) == true);
}
​

Impact

This issue could significantly impact the future of the protocol, as the number of participants in future events would be negatively impacted by this issue

Tools Used

Manual review

Recommendations

function stopEvent() external onlyOwner {
require(block.timestamp >= eventEndTime, "Event is not ended");
for (uint256 i = 0; i < participants.length; i++) {
isProducer[participants[i]] = false;
+ _participants[participants[i]] = false;
}
}
Updates

Lead Judging Commences

bube Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

_participants is not updated

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.