Submission Details
Severity:
Player can join even after event ends, resulting in no chance of winning and funds locked in contract forever
Summary
Players should only be allowed to join between a particular period to avoid players from joining after the event hence losing funds to be locked in contract forever
Vulnerability Details
place below code in Dussehra.t.sol and run forge test --mt test__PlayerCanJoinAfterEvent
code
function test__PlayerCanJoinAfterEvent() public {
vm.startPrank(player1);
vm.deal(player1, 1 ether);
dussehra.enterPeopleWhoLikeRam{value: 1 ether}();
vm.warp(1728777600);
vm.startPrank(organiser);
choosingRam.selectRamIfNotSelected(); // selecting ram
vm.stopPrank();
dussehra.killRavana(); // killing ravana
vm.startPrank(player1);
dussehra.withdraw(); // withdrawing by ram
vm.startPrank(player2);
vm.deal(player2, 1 ether);
dussehra.enterPeopleWhoLikeRam{value: 1 ether}(); // joining after event ends
assertEq(address(dussehra).balance, 1 ether);
vm.warp(1728777669 + 1);
vm.expectRevert();
dussehra.killRavana(); // killing ravana after event ends is not possible
vm.expectRevert();
vm.startPrank(player1);
dussehra.withdraw(); // ram cant withdraw as reward is claimed
vm.startPrank(player2);
vm.expectRevert();
dussehra.withdraw(); // even player2 cant withdraw hence funds are locked
}
Impact
Funds locked in contract forever
Tools Used
Recommendations
make below changes in Dussehra.sol
+ error Dussehra__EventEnded();
function enterPeopleWhoLikeRam() external payable {
+ if(block.timestamp > 1728777669){
+ revert Dussehra__EventEnded();
+ }
...
}
Updates
Lead Judging Commences
bube about 1 year ago
Submission Judgement Published Reason: Non-acceptable severity
Assigned finding tags:
Invalid - enter people after event or after Ram is selected
It is the user's responsibility to check the date of the event.
Rewards breakdown
nSLOC
218This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.