Christmas Dinner
First Flight #31
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

`ChristmasDinner::setDeadline` function lacks important input parameter check

appet

Summary

ChristmasDinner::setDeadline function takes as input parameter (uint256 _days) for which lacks a check to be greater than zero (>0)

Vulnerability Details

By omissive or intentional setting of _days parameter to =0, deadline will become = block.timestamp.

The calculation is as follows:

block.timestamp + _days * 1 days = block.timestamp + 0 = block.timestamp

PoC

Copy the following code in the test suite and observe the revert reason:

function test_trySettingDeadlineAsZero() public {
vm.startPrank(deployer);
cd.setDeadline(0 days);
uint deadlineTime = cd.deadline();
vm.stopPrank();
assertEq(deadlineTime, block.timestamp);
​
vm.warp(block.timestamp + 1);
vm.startPrank(user1);
vm.expectRevert();
cd.deposit(address(wbtc), 1e18);
vm.stopPrank();
​
​
}

Impact

By passing 0 as input parameter to the ChristmasDinner::setDeadline function would cause it to immediately expire upon being set because the deadline would be already equal to the current block.timestamp and any subsequent transaction will have a later timestamp.
This would block ChristmasDinner::deposit, ChristmasDinner::refund and partially ChristmasDinner::changeParticipationStatus as they rely either on the beforeDeadline modifier or directly on the state variable deadline.
Additionally (although problematic and part of another issue) the project obviously intends for the deadline to be set once and not to be changed after by anyone, including the host.
As this could influence ~ half of the protocol's functionality, primarily external functions, it should be considered as a serious vulnerability.

Tools Used

Manual review, Foundry

Recommendations

Add input validation in ChristmasDinner::setDeadline to prevent invalid values for _days:

function setDeadline(uint256 _days) external onlyHost {
if (deadlineSet) {
revert DeadlineAlreadySet();
}
+ ---> require(_days > 0, "Days must be positive"); // Ensure valid input
deadline = block.timestamp + _days * 1 days;
emit DeadlineSet(deadline);
}
Updates

Lead Judging Commences

0xtimefliez Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!