Christmas Dinner
First Flight #31
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Anyone can be a participant even without depositing

etijie

Summary

The ChristmasDinner::changeParticipationStatus function allows any user to change participation without a check for deposit. This enables users to mark themselves as participants in the event without contributing any funds contrary to the intention of the contract.

Vulnerability Details

Proof of Concept:

  1. Deploy the ChristmasDinner contract with valid token 2. addresses.

  2. A user who has not deposited any funds calls the ChristmasDinner::changeParticipationStatus function before the deadline.

  3. Verify that the user's participation status is set to true despite not contributing any deposits.

// Assume the contract is deployed at a known address.
ChristmasDinner contract = ChristmasDinner(address_of_deployed_contract);
​
// An attacker calls changeParticipationStatus without depositing.
contract.changeParticipationStatus();
​
// Verify that the attacker is now marked as a participant.
bool isParticipant = contract.getParticipationStatus(attackerAddress);
require(isParticipant == true, "The attacker should be marked as a participant without depositing.");

Impact

Unauthorised users can exploit this to falsely sign up without sending funds to the contract.

Tools Used

foundry, aderyn, manual audit

Recommendations

Update theChristmasDinner::changeParticipationStatus function to validate whether the user has made a deposit before toggling their participation status to true. This can be achieved by checking the user's deposit balances:

function changeParticipationStatus() external {
if (participant[msg.sender]) {
participant[msg.sender] = false;
} else if (!participant[msg.sender] && block.timestamp <= deadline) {
// Ensure the user has deposited before allowing them to participate
if (balances[msg.sender][address(i_WBTC)] == 0 &&
balances[msg.sender][address(i_WETH)] == 0 &&
balances[msg.sender][address(i_USDC)] == 0 &&
etherBalance[msg.sender] == 0) {
revert("You must deposit funds to participate.");
}
participant[msg.sender] = true;
} else {
revert BeyondDeadline();
}
emit ChangedParticipation(msg.sender, participant[msg.sender]);
}
Updates

Lead Judging Commences

0xtimefliez Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

usage of change participation logic circumvents deposit

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!