First Flight #13: Baba Marta
First Flight #13
Beginner FriendlyFoundryGameFi
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

`MartenitsaEvent::stopEvent` does not reset participants, which prevents users who joined once from joining future events

irondevx

Summary

Once the user joins a Martenitsa event, they are unable to join future events due to bad participants management after the event ends.

Vulnerability Details

The MartenitsaEvent smart contract implements an event system where users can join and temporarily become producers, so that they can create and sell MartenitsaTokens.

However, once the user joins an event, they are permanently recorded in the _participants mapping and never removed from it, preventing them from joinining future events.

Impact

This issue leads to unintended denial of participation for users who are eligible to join Martenitsa events by having enough HealthTokens.

Tools Used

Foundry, manual review

Proof of Code

Code Add the following code to the `MartenitsaEvent.t.sol` file:
modifier getMartenitsas(uint256 amount) {
uint256 tokenId = 0;
​
vm.startPrank(chasy);
for(uint256 i = 0; i < amount; i++){
martenitsaToken.createMartenitsa(string(abi.encodePacked("bracelet-", i)));
marketplace.listMartenitsaForSale(tokenId, 1 wei);
martenitsaToken.approve(address(marketplace), tokenId);
marketplace.makePresent(bob, tokenId);
tokenId++;
}
vm.stopPrank();
​
_;
}
​
function test__JoinEvent__FailsAfterInitialJoin() public getMartenitsas(6) {
// ********** Setup - Bob gets their 2 HTs **********
vm.startPrank(bob);
marketplace.collectReward();
assertEq(healthToken.balanceOf(bob), 2 * 10**18); // Confirm that Bob has enough HT to join the event
healthToken.approve(address(martenitsaEvent), type(uint256).max);
vm.stopPrank();
​
// ********** Start event **********
martenitsaEvent.startEvent(1 days);
​
// ********** Bob joins the event *********
vm.startPrank(bob);
martenitsaEvent.joinEvent();
assertEq(healthToken.balanceOf(bob), 1 * 10**18); // Bob sent their 1 HT as a requirement to join
vm.stopPrank();
​
// ********** Stop the event and start it again **********
vm.warp(block.timestamp + 1 days + 1);
martenitsaEvent.stopEvent();
martenitsaEvent.startEvent(1 days);
​
// ********** Attempt to join the event again **********
vm.startPrank(bob);
vm.expectRevert("You have already joined the event");
martenitsaEvent.joinEvent();
vm.stopPrank();
​
assertEq(martenitsaEvent.participants(0), bob); // Confirm that Bob is still a participant
assertEq(martenitsaEvent.isProducer(bob), false); // but is not a producer
}

Recommendations

Modify the MartenitsaEvent::stopEvent function to reset both the participants array and the participants mapping, allowing them to rejoin future events:

function stopEvent() external onlyOwner {
require(block.timestamp >= eventEndTime, "Event is not ended");
​
for (uint256 i = 0; i < participants.length; i++) {
isProducer[participants[i]] = false;
+ delete _participants[participants[i]];
}
​
+ delete participants;
}
Updates

Lead Judging Commences

bube Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

_participants is not updated

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.