Christmas Dinner

Summary

The setDeadline function in the ChristmasDinner contract allows the host to set a deadline for the event. However, there is a bug that prevents the deadlineSet state variable from being set to true after the deadline is initially set. This causes the setDeadline function to always allow modifications to the deadline, even if it has been set previously.

Vulnerability Details

• Function affected: setDeadline(uint256 _days)

• Issue: The deadlineSet state variable is never set to true after the deadline is set for the first time. As a result, the condition if(deadlineSet) will never evaluate to true after the first call to setDeadline. This allows the host to repeatedly change the deadline, even if it was already set previously.

  The current implementation:

  function setDeadline(uint256 _days) external onlyHost {

  if(deadlineSet) {

  revert DeadlineAlreadySet();

  } else {

  deadline = block.timestamp + _days * 1 days;

  emit DeadlineSet(deadline);

  }

  }

  • The check if(deadlineSet) is used to ensure that the deadline can only be set once. However, since deadlineSet is never updated to true, the check will always pass as false for every call, allowing the host to change the deadline any number of times.

Impact

• Unintended Deadline Changes: The deadlineSet state variable should ensure that the deadline can only be set once. Because it is not updated to true after setting the deadline, the host can change the deadline multiple times, which could break the expected logic and planning for event participants.

• Potential for Manipulation: The host could repeatedly change the deadline, potentially creating confusion and invalidating the event planning process

Tools Used

Manual code review

Recommendations

1. Update deadlineSet State Variable: After setting the deadline, the contract should update the deadlineSet state variable to true to prevent further changes to the deadline.

   Suggested fix:

   function setDeadline(uint256 _days) external onlyHost {

   if(deadlineSet) {

   revert DeadlineAlreadySet();

   } else {

   deadline = block.timestamp + _days * 1 days;

   deadlineSet = true; // Set deadlineSet to true to prevent further changes

   emit DeadlineSet(deadline);

   }

   }

2. Ensure One-Time Deadline Set: With the deadlineSet variable properly updated, the contract will correctly enforce that the deadline can only be set once. Further attempts to modify the deadline will be blocked by the DeadlineAlreadySet revert.

3. Test Thoroughly: Ensure that the deadlineSet variable behaves as expected through unit tests to confirm that the deadline can only be set once.