Christmas Dinner

Summary

The refund() function implements a mutex lock to prevent reentrancy. However, the lock implementation is incorrect, allowing the function to be exploited.

Vulnerability Details

• The locked variable is set to false after the function execution, rather than before. This enables malicious contracts to re-enter the function.

  Steps To Reproduce

• Write a malicious contract that calls the refund() function recursively.

• Deploy the ChristmasDinner contract.

• Deploy the malicious contract and deposit funds into ChristmasDinner.

• Execute the reentrancy attack by calling the malicious contract.

Impact

An attacker can drain funds from the contract by repeatedly calling refund() before the locked variable is reset.

Tools Used

Foundry

Recommendations

• Set locked to true at the start of the refund() function and reset it to false after execution.