Submission Details
Severity:
receive()
Summary
The receive() function in the contract is missing a check to ensure that msg.value is greater than zero.
Vulnerability Details
The receive() function updates the etherBalance mapping and emits event even when msg.value could be zero. This could allow users to appear as participants without actually paying Ether.
receive() external payable {
etherBalance[msg.sender] += msg.value;
emit NewSignup(msg.sender, msg.value, true);
}
Impact
Mark users as participants for free.
Tools Used
Manual review
Recommendations
Check to ensure that msg.value is greater than zero before updating the etherBalance and emitting event.
receive() external payable {
require(msg.value > 0, "Not enough ETH");
etherBalance[msg.sender] += msg.value;
emit NewSignup(msg.sender, msg.value, true);
}
Rewards breakdown
nSLOC
129This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.