Submission Details
Severity:
People can call `Dussehra::enterPeopleWhoLikeRam` after the event end.
Description
Dussehra::enterPeopleWhoLikeRam do not check if the event is ended or not. Thus, any users can mint a RamNFT after the end of the event.
@> function enterPeopleWhoLikeRam() public payable {
if (msg.value != entranceFee) {
revert Dussehra__NotEqualToEntranceFee();
}
if (peopleLikeRam[msg.sender] == true) {
revert Dussehra__AlreadyPresent();
}
peopleLikeRam[msg.sender] = true;
WantToBeLikeRam.push(msg.sender);
ramNFT.mintRamNFT(msg.sender);
emit PeopleWhoLikeRamIsEntered(msg.sender);
}
Risk
Likelyhood: High
Anyone can mint an NFT after the event end.
Impact: Low
Since the token has a value only during the event, it would not be a great benefit to sell them.
Recommended Mitigation
Check if the event is ended before minting a new token.
Updates
Lead Judging Commences
bube over 1 year ago
Submission Judgement Published Reason: Non-acceptable severity
Assigned finding tags:
Invalid - enter people after event or after Ram is selected
It is the user's responsibility to check the date of the event.
Rewards breakdown
nSLOC
218This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.