First Flight #17: Dussehra
First Flight #17
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

`Dussehra::enterPeopleWhoLikeRam` function allows users to enter event after Ravana is killed, ETH can stuck in contract forever

kazan

Decription

Users that want to enter the event like Ram should enter before 12th October 2024. Because after that, the selected Ram may be chosen and kill Ravana anytime. But, the enterPeopleWhoLikeRam function do not check if Ram is selected or Ravana is killed or not. And users can enter in the event anytime after.

Impact

  1. If users enter after Ram is selected and before Ram kill Ravana, they will not have a chance to become Ram because Ram is selected. Their money as entranceFee will be send to the organiser when Ram kill Ravana and to Ram when Ram withdraw.

  2. If user enter after Ram kill Ravana, the entranceFee users have to pay for entering event will stuck in contract forever because Dussehra contract doesn't have function to send money back to these users.

Tools Used

  • Manual review

  • Foundry

PoC

Place this test in Dussehra.t.sol

function test_canJoinAfterSelectRamIfNotSelectedAndLostMoney() public participants {
vm.warp(1728691200 + 1);
​
vm.startPrank(organiser);
choosingRam.selectRamIfNotSelected();
vm.stopPrank();
​
vm.startPrank(player3);
vm.deal(player3, 1 ether);
dussehra.enterPeopleWhoLikeRam{value: 1 ether}();
vm.stopPrank();
​
vm.startPrank(player2);
dussehra.killRavana();
dussehra.withdraw();
vm.stopPrank();
}

Test pass, player 3 doesn't have a chance to become Ram and lost money.

Recommendations

Add checking when user enter in the event that Ram must be not selected yet.

function enterPeopleWhoLikeRam() public payable {
+ require(!choosingRamContract.isRamSelected(), "Ram was selected!");
.
.
.
}
Updates

Lead Judging Commences

bube Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Invalid - enter people after event or after Ram is selected

It is the user's responsibility to check the date of the event.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.