Christmas Dinner
First Flight #31
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Malicious User Can Become Host Without Depositing:

etijie

Summary

Description:
The ChristmasDinner::changeHost function allows anyone to become a host without verification of deposit. A malicious user can become a participant and qualify for host status by toggling their participation status to true using the ChristmasDinner::changeParticipationStatus function (even without depositing) and then using the ChristmasDinner::changeHost function to assume the host role. This enables the malicious user to withdraw all funds from the contract.

Vulnerability Details

Proof of Concept:

// Assume the contract is deployed at a known address.
ChristmasDinner contract = ChristmasDinner(address_of_deployed_contract);
​
// Step 1: Malicious user becomes a participant without depositing.
contract.changeParticipationStatus();
​
// Step 2: Host makes Malicious user the new host
contract.changeHost(maliciousUserAddress);
​
// Step 3: Malicious host withdraws all funds.
contract.withdraw();

Impact

. A malicious user can assume control as the host without contributing to the event.
. Unauthorized withdrawal of all contract funds by the malicious host, leading to a complete loss of deposits

Tools Used

slither, aderyn, foundry, manual

Recommendations

Update the ChristmasDinner::changeHost function to verify that the new host has a non-zero deposit balance before allowing the role change.

function changeHost(address _newHost) external onlyHost {
if (!participant[_newHost]) {
revert OnlyParticipantsCanBeHost();
}
// Ensure the new host has deposited funds
if (balances[_newHost][address(i_WBTC)] == 0 &&
balances[_newHost][address(i_WETH)] == 0 &&
balances[_newHost][address(i_USDC)] == 0 &&
etherBalance[_newHost] == 0) {
revert("New host must have a non-zero deposit balance.");
}
host = _newHost;
emit NewHost(host);
}
Updates

Lead Judging Commences

0xtimefliez Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

usage of change participation logic circumvents deposit

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!