Christmas Dinner
First Flight #31
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

receive() logic should be same as deposit()

riceee

Summary

receive() should check and set participant status and emit proper events.

Vulnerability Details

This function doesn't check whether the sender is already a participant or not, neither updates the participant status on signup Resulting in always NewSignup event emission but no record in storage which is misleading. It also allows a user to keep depositing ether even after the deadline is over, resulting in wrong deposit logic.

receive() external payable {
etherBalance[msg.sender] += msg.value;
emit NewSignup(msg.sender, msg.value, true);
}

Impact

User, although being an active participant loses his privelege to access participant only functions. Which could potentially lead to inaccessible funds on the user's end.

Tools Used

Manual Review

Recommendations

add if-else conditon to check for old/new participant as well as update participation status and deadline modifier (same as deposit logic)

receive() external payable beforeDeadline {
//Implemented proper logic as deposit
if(participant[msg.sender]) {
etherBalance[msg.sender] += msg.value;
emit GenerousAdditionalContribution(msg.sender, msg.value);
}else{
participant[msg.sender] = true;//added
etherBalance[msg.sender] += msg.value;
emit NewSignup(msg.sender, msg.value, true);
}
}
Updates

Lead Judging Commences

0xtimefliez Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

receive does not update participation status

Appeal created

riceee Submitter
about 1 year ago
0xtimefliez Lead Judge
about 1 year ago
riceee Submitter
about 1 year ago
0xtimefliez Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

receive does not update participation status

receive() function independant from deadline

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!