Christmas Dinner

Summary

The deposit() function has a comment stating "Allows a user to sign-up other users," but this functionality is not clearly implemented or defined in the code.

Vulnerability Details

The comment in the deposit() function suggests that users can sign up other users. However, the code does not explicitly show how this is achieved. The current implementation only updates the balances and participant status of msg.sender.

Impact

• Unclear Functionality: The intended behavior of signing up other users is not clear, leading to potential confusion and misinterpretation.

• Potential for Misuse: If the functionality is not implemented as intended, it could be misused or lead to unexpected behavior.

Tools Used

• Manual Code Review

Recommendations

1. Clarify the Logic: Clearly define how a user can sign up another user. This might involve adding a new parameter to the deposit() function (e.g., address _userToSignUp) or providing a separate function for this purpose.

2. Implement the Functionality: Implement the logic based on the clarified requirements. This might involve updating the balances and participant status of the user being signed up, in addition to or instead of msg.sender.

3. Update Comments: Update the comments to accurately reflect the implemented functionality.

   function deposit(address _token, uint256 _amount, address _userToSignUp) external beforeDeadline {

   require(_amount > 0, "Amount must be greater than zero");

   require(whitelisted[_token], "Token not supported");

   require(IERC20(_token).allowance(msg.sender, address(this)) >= _amount, "Insufficient allowance");

   ​

   if(participant[_userToSignUp]){

   balances[_userToSignUp][_token] += _amount;

   IERC20(_token).safeTransferFrom(msg.sender, address(this), _amount);

   emit GenerousAdditionalContribution(_userToSignUp, _amount);

   } else {

   participant[_userToSignUp] = true;

   balances[_userToSignUp][_token] += _amount;

   IERC20(_token).safeTransferFrom(msg.sender, address(this), _amount);

   emit NewSignup(_userToSignUp, _amount, getParticipationStatus(_userToSignUp));

   }

   }