Christmas Dinner
First Flight #31
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing Access Control in receive() Function

abduo_ov

Description:

The receive() function allows anyone to send Ether to the contract, and their balance (etherBalance) is updated. However, there is no check to ensure that the sender is a participant or authorized user.

Impact:

An unauthorized user can deposit Ether without restrictions, potentially leading to inconsistency or misuse.

Proof of Concept (PoC):

  1. Any user can call the receive() function by sending Ether:

address(target).call{value: 1 ether}("");
​

  1. Ether balance is updated for the sender, even if they are not a participant.

  2. This could lead to inconsistencies in participation logic.

Recommendation:

  • Add a validation check to ensure that only participants (or eligible users) can deposit Ether via receive().

  • Example:

if (!participant[msg.sender]) {
revert NotParticipant();
}
​
Updates

Lead Judging Commences

0xtimefliez Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!