Submission Details
Severity:
H-06: Users can become participant by changing status before deadline
Summary
ChristmasDinner::changeParticipationStatus() allows users to become a participant before the deadline without depositing any tokens or ether.
Vulnerability Details
Users who have not deposit before will always return false when you call participant[msg.sender]. Hence, the function ChristmasDinner::changeParticipationStatus() allows any users to change their status to true before deadline.
function changeParticipationStatus() external {
if(participant[msg.sender]) {
participant[msg.sender] = false;
} else if(!participant[msg.sender] && block.timestamp <= deadline) {
participant[msg.sender] = true;
} else {
revert BeyondDeadline();
}
emit ChangedParticipation(msg.sender, participant[msg.sender]);
}
Impact
function testParticipateByChangingStatus() public {
vm.startPrank(user1);
// Without depositing any tokens or ether, just call changeParticipationStatus() before deadline
cd.changeParticipationStatus();
assertEq(cd.getParticipationStatus(user1), true, "User1 is not participant");
}
Results
[PASS] testParticipateByChangingStatus() (gas: 39020)
Traces:
[39020] CDTest::testParticipateByChangingStatus()
├─ [0] VM::startPrank(user1: [0x29E3b139f4393aDda86303fcdAa35F60Bb7092bF])
│ └─ ← [Return]
├─ [26604] ChristmasDinner::changeParticipationStatus()
│ ├─ emit ChangedParticipation(: user1: [0x29E3b139f4393aDda86303fcdAa35F60Bb7092bF], : true)
│ └─ ← [Stop]
├─ [638] ChristmasDinner::getParticipationStatus(user1: [0x29E3b139f4393aDda86303fcdAa35F60Bb7092bF]) [staticcall]
│ └─ ← [Return] true
├─ [0] VM::assertEq(true, true, "User1 is not participant") [staticcall]
│ └─ ← [Return]
└─ ← [Stop]
Suite result: ok. 1 passed; 0 failed; 0 skipped; finished in 3.19s (862.87µs CPU time)
Tools Used
Recommendations
Add a mapping to track who are the users that have deposit before. Then check if the user exist before changing participant status.
Updates
Lead Judging Commences
0xtimefliez about 1 year ago
Submission Judgement Published Assigned finding tags:
usage of change participation logic circumvents deposit
Rewards breakdown
nSLOC
129This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.