Christmas Dinner
First Flight #31
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Infinite Deadline Reset Vulnerability in `ChristmasDinner::setDeadline` function

appet

Summary

The ChristmasDinner::setDeadline function in the contract is designed to allow the host to set a deadline for the event. However, the implementation contains a vulnerability where the deadlineSet state variable is never updated to true (neither is by another implementation in the contract). This oversight allows the deadline to be reset infinitely by the host, undermining the intended logic of the function and potentially disrupting the event planning process.

Vulnerability Details

The if (deadlineSet) condition (ln.185-186) is intended to prevent multiple invocations of ChristmasDinner::setDeadline. However, the deadlineSet state variable is initialized to false and is never updated to true within the function or elsewhere in the contract.
This omission results in the if (deadlineSet) condition always evaluating to false, effectively rendering the check useless.
Consequently, the host can call the setDeadline function multiple times, overriding the previous deadline each time.

PoC

Paste the following test in the test suite:

function test_SettingDeadline() public {
vm.startPrank(deployer);
bool ifdeadlineset = cd.deadlineSet();
​
cd.setDeadline(1 days);
assertEq(ifdeadlineset, false);
vm.warp(5);
cd.setDeadline(2 days);
assertEq(ifdeadlineset, false);
​
vm.warp(10);
cd.setDeadline(3 days);
assertEq(ifdeadlineset, false);
​
vm.stopPrank();
​
}

Impact

This vulnerability allows the host to reset the deadline at will, leading to:
- Uncertainty and lack of trust among participants, as the deadline can be arbitrarily altered.
- Potential disruption to the event organization, as planning and budgeting depend on a fixed deadline.
- Exploitation risks if the host deliberately manipulates the deadline for malicious purposes.

Tools Used

Manual review

Recommendations

The following fix can be applied:

function setDeadline(uint256 \_days) external onlyHost {
if (deadlineSet) {
revert DeadlineAlreadySet();
} else {
deadline = block.timestamp + \_days \* 1 days;
​
* \---> deadlineSet = true; // Fix: Update the state variable to prevent multiple calls
emit DeadlineSet(deadline);
}
}
Updates

Lead Judging Commences

0xtimefliez Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

deadline is never set to true

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!