First Flight #17: Dussehra
First Flight #17
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Users Can Enter the Event After Ram is Selected

yaioxy

Summary

The Dussehra::enterPeopleWhoLikeRam function does not have a modifier to check if Ram has been selected before allowing users to enter the event. This means that users who enter the event after Ram has been selected will never have a chance to win, even though they have paid the entrance fee.

Vulnerability Details

the enterPeopleWhoLikeRam function does not have any checks to ensure that Ram has not been selected before allowing users to enter the event. The function is defined as follows:

function enterPeopleWhoLikeRam() public payable {
if (msg.value != entranceFee) {
revert Dussehra__NotEqualToEntranceFee();
}
​
if (peopleLikeRam[msg.sender] == true) {
revert Dussehra__AlreadyPresent();
}
​
peopleLikeRam[msg.sender] = true;
WantToBeLikeRam.push(msg.sender);
ramNFT.mintRamNFT(msg.sender);
emit PeopleWhoLikeRamIsEntered(msg.sender);
}

However, according to the documentation, once Ram has been selected, no further changes can be made to the characteristics of the participants.

They may even enter after the event has ended and their funds will be stuck in the contract since there is no way to retrieve funds outside the event.

Impact

Users who enter the event after Ram has been selected will never have a chance to win, as their characteristics cannot be updated, and they will not be eligible to become Ram. However, they will still have to pay the entrance fee, resulting in a loss of funds for these users.

Tools Used

Manual review

Recommendations

Add a modifier that checks if Ram has been selected before allowing users to enter the event.

Here's an example of how the modifier could be implemented:

modifier RamNotSelected() {
require(!choosingRamContract.isRamSelected(), "Ram has already been selected!");
_;
}

Then, this modifier can be added to the enterPeopleWhoLikeRam function:

function enterPeopleWhoLikeRam() public payable RamNotSelected {
// ...
}
Updates

Lead Judging Commences

bube Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Invalid - enter people after event or after Ram is selected

It is the user's responsibility to check the date of the event.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.