Christmas Dinner
First Flight #31
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Lack of minimum amount check in deposit function allows entry of infinite participants

w33ked

Summary

Lack of a miminum deposit amount on deposit and receive functions means a user can enter as participant with a 0 amount. This insufficient check can allow a user to spam event host with a large number of participants.

Vulnerability Details

ChristmasDinner::depositand ChristmasDinner::receive functions lack require statement to ensure amount sent is higher than zero.

Impact

Malicious user can spam event host with an infinite number of participants, making a tideous work to verify other genuine participants and make good planning for the event.

Tools Used

Manual review

Recommendations

Ensure a positive amount in deposit and receive functions

Add this line to the deposit function:

function deposit(address _token, uint256 _amount) external beforeDeadline {
// Check if the amount is greater than 0
++ require(_amount > 0, "Amount must be greater than zero");
​
if (!whitelisted[_token]) {
revert NotSupportedToken();
}
if (participant[msg.sender]) {
balances[msg.sender][_token] += _amount;
IERC20(_token).safeTransferFrom(msg.sender, address(this), _amount);
emit GenerousAdditionalContribution(msg.sender, _amount);
} else {
participant[msg.sender] = true;
balances[msg.sender][_token] += _amount;
IERC20(_token).safeTransferFrom(msg.sender, address(this), _amount);
emit NewSignup(
msg.sender,
_amount,
getParticipationStatus(msg.sender)
);
}
}

add this line to the receive function

receive() external payable {
++ require(msg.value > 0, "Must send more than 0 ETH");
etherBalance[msg.sender] += msg.value;
emit NewSignup(msg.sender, msg.value, true);
}
Updates

Lead Judging Commences

0xtimefliez Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!