First Flight #17: Dussehra
First Flight #17
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

organiser may fail to call `ChoosingRam::selectRamIfNotSelected`, resulting in no one winning reward

Mahith

Summary

So, ChoosingRam::selectRamIfNotSelected, only organiser can call this function between the event time. if no winner is selected by increaseValuesOfParticipants & event ends and for some reason, organiser decides to act malicious and not call the function, then, no one will win and money is locked into the contract forever.

Vulnerability Details

place below code in Dussehra.t.sol and run command: forge test --mt test__fundsLocked

function test__fundsLocked() public participants {
vm.warp(1728777600 + 1); // 2 participants are already there with event finished
​
vm.expectRevert();
vm.startPrank(organiser);
choosingRam.selectRamIfNotSelected(); // selecting ram after event ends is not possible
vm.stopPrank();
​
vm.expectRevert();
dussehra.killRavana(); // killing ravana after event ends is not possible
​
vm.expectRevert();
dussehra.withdraw(); // withdrawing after event ends is not possible
​
assertEq(address(dussehra).balance, 2 ether); // funds are locked
}

Impact

possibility of funds being locked in contract forever

Tools Used

Foundry, chainlink oracles

Recommendations

  1. Allow anyone to call ChoosingRam::selectRamIfNotSelected to not worry about trusting single organiser/entity.

  2. Allow ChoosingRam::selectRamIfNotSelected to be called even after event ended as there isn't any downside for allowing so.

  3. Better way to handle this situation is to use something like chainlink Automation or keepers which triggers upkeep and executes function ChoosingRam::selectRamIfNotSelected based on CRON job called as time based upkeep. you can read more about it at chainlink

third method is decentralised way to handle the situation without relying on anyone such that ChoosingRam::selectRamIfNotSelected will be called and executed at a particular time interval irrespective of anything.

Updates

Lead Judging Commences

bube Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Invalid - `selectRamIfNotSelected` is not called

The organizer is trusted and he/she will call the `selectRamIfNotSelected`.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.