Submission Details
Severity:
M-03: `ChristmasDinner::deposit()` is missing the feature to sign-up on behalf of other users
Summary
The ChristmasDinner::deposit() function is suppose to include the feature to sign-up on behalf other users but it is missing.
Vulnerability Details
function deposit(address _token, uint256 _amount) external beforeDeadline {
if(!whitelisted[_token]) {
revert NotSupportedToken();
}
if(participant[msg.sender]){
balances[msg.sender][_token] += _amount;
IERC20(_token).safeTransferFrom(msg.sender, address(this), _amount);
emit GenerousAdditionalContribution(msg.sender, _amount);
} else {
participant[msg.sender] = true;
balances[msg.sender][_token] += _amount;
IERC20(_token).safeTransferFrom(msg.sender, address(this), _amount);
emit NewSignup(msg.sender, _amount, getParticipationStatus(msg.sender));
}
}
Impact
As stated in the protocol documentation to allow a user to sign-up on behalf of other users. However, ChristmasDinner::deposit() is missing this feature.
Tools Used
Recommendations
Add in the logic to allow a user to sign-up on behalf of other users.
Updates
Lead Judging Commences
0xtimefliez about 1 year ago
Submission Judgement Published Assigned finding tags:
Deposit function lacks functionality
Rewards breakdown
nSLOC
129This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.