First Flight #17: Dussehra
First Flight #17
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

`organiser` or `SelectedRam` without `receive` or `fallback` functions will not be able to receive rewards

codexbugmenot

Summary

The Dussehra.sol disperses the funds to the organiser when killRavana function is called and the SelectedRam receives funds when withdraw function is called but if either of them is a smart contract address without receive or fallback functions then the funds will be permanently stuck in the contract

Vulnerability Details

The smart contract addresses without receive or fallback functions will not be able to receive rewards

For the below Poc to work add the following changes in Dussehra.t.sol

  1. create a new contract as given

contract PlayerContract {
function onERC721Received(address operator, address from, uint256 tokenId, bytes calldata data)
external
returns (bytes4)
{
return IERC721Receiver.onERC721Received.selector;
}
}

  1. Add this import statement at the top import {IERC721Receiver} from "../lib/openzeppelin-contracts/contracts/token/ERC721/IERC721Receiver.sol";

  2. Declare a new state variable PlayerContract playerContract;

  3. In setup add the following line

    playerContract = new PlayerContract();
PoC: cannot withdraw if No Receive or Fallback
​
function test_cannotwithdrawifNoReceiveorFallback() public {
vm.startPrank(address(playerContract));
vm.deal(address(playerContract), 1 ether);
dussehra.enterPeopleWhoLikeRam{value: 1 ether}();
vm.stopPrank();
​
vm.warp(1728691200 + 1);
vm.startPrank(organiser);
choosingRam.selectRamIfNotSelected();
vm.stopPrank();
​
vm.startPrank(address(playerContract));
dussehra.killRavana();
vm.stopPrank();
// The `withdraw()` reverts here
// same behaviour is expected is organiser is a smart contract
vm.expectRevert();
vm.startPrank(address(playerContract));
dussehra.withdraw();
vm.stopPrank();
}
​
​

Impact

The funds will be permanently stuck in the contract

Tools Used

  1. Manual Review

  2. Foundry

Recommendations

For the organiser the responsibility has to be taken by the protocol and as for the SelectedRam the Dussehra::withdraw function should take an address arg to transfer funds to which would place the responsibility on the user to safely transfer his funds.

Updates

Lead Judging Commences

bube Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Info/Gas/Invalid according to docs

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.