Submission Details
Severity:
M-01: `ChristmasDinner::deadline` is initialized as 0 and prevents users from depositing if the deadline is not set by host
Summary
In the contract, the ChristmasDinner::deadline is initialized as 0 and if the host does not set the deadline, ChristmasDinner::deposit() will always revert on BeyondDeadline() and prevents users from depositing.
Vulnerability Details
The modifier beforeDeadline() will revert because block.timestamp is bigger than 0.
modifier beforeDeadline() {
if(block.timestamp > deadline) {
revert BeyondDeadline();
}
_;
}
Impact
Note: The setDeadline() in setUp() has been commented out
function testCannotDepositIfDeadlineNotSet() public {
vm.startPrank(user1);
vm.expectRevert(ChristmasDinner.BeyondDeadline.selector);
cd.deposit(address(wbtc), 2e18);
vm.stopPrank();
}
Results
[PASS] testCannotDepositIfDeadlineNotSet() (gas: 15752)
Traces:
[15752] ChristmasDinnerTest::testCannotDepositIfDeadlineNotSet()
├─ [0] VM::startPrank(user1: [0x29E3b139f4393aDda86303fcdAa35F60Bb7092bF])
│ └─ ← [Return]
├─ [0] VM::expectRevert(BeyondDeadline())
│ └─ ← [Return]
├─ [2534] ChristmasDinner::deposit(ERC20Mock: [0x5615dEB798BB3E4dFa0139dFa1b3D433Cc23b72f], 2000000000000000000 [2e18])
-> │ └─ ← [Revert] BeyondDeadline()
├─ [0] VM::stopPrank()
│ └─ ← [Return]
└─ ← [Stop]
Suite result: ok. 1 passed; 0 failed; 0 skipped; finished in 4.19s (64.38µs CPU time)
Tools Used
Recommendations
Include setting deadline in the constructor
constructor (address _WBTC, address _WETH, address _USDC, uint256 _deadline) {
host = msg.sender;
i_WBTC = IERC20(_WBTC);
whitelisted[_WBTC] = true;
i_WETH = IERC20(_WETH);
whitelisted[_WETH] = true;
i_USDC = IERC20(_USDC);
whitelisted[_USDC] = true;
+ deadline = _deadline;
+ deadlineSet = true;
}
Rewards breakdown
nSLOC
129This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.