Christmas Dinner
First Flight #31
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Misleading Event Emission for Ether Deposits in receive() Function

nitzz

Summary

The receive() function emits the NewSignup event for all Ether deposits, regardless of whether the sender is a new participant or an existing participant adding more Ether. This can create misleading logs, as it might appear that a new participant has joined when an existing one has only contributed additional funds.

Vulnerability Details

The issue lies in the receive function, which emits the NewSignup event unconditionally when Ether is received. It does not check whether the sender is already a participant, conflating new signups with additional Ether contributions.

receive() external payable {
etherBalance[msg.sender] += msg.value;
emit NewSignup(msg.sender, msg.value, true);
}

The NewSignup event should only be emitted for new participants, ensuring the event logs accurately reflect participant signups

Impact

-> Observers might misinterpret the event logs, believing more participants have joined than actually have.
-> Systems or analytics tools relying on event data might overcount participants or miscalculate contributions.
-> The host and participants could make planning decisions based on incorrect assumptions about participation levels.

Tools Used

Manual code review of the receive function.

Recommendations

Add a conditional check to determine if the sender is a new participant or an existing one:

receive() external payable {
etherBalance[msg.sender] += msg.value;
if (!participant[msg.sender]) {
participant[msg.sender] = true;
emit NewSignup(msg.sender, msg.value, true); // For new participants
} else {
emit AdditionalEtherContribution(msg.sender, msg.value); // For additional contributions
}
}
Updates

Lead Judging Commences

0xtimefliez Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!