Christmas Dinner

Summary

The receive() function allows any user to send Ether and be marked as a participant without restrictions.

Vulnerability Details

• The contract does not verify if the user should be a participant when sending Ether, potentially resulting in abuse or spam.

• Steps to reproduce :

• Deploy the ChristmasDinner contract.

• Call the receive() function with a minimal Ether value multiple times.

• Check the participant mapping for the sender's address.

• Verify that the sender is added as a participant each time.

Impact

An attacker could manipulate the participant list by sending small amounts of Ether repeatedly.

Tools Used

Foundry

Recommendations

• Add validation logic to restrict who can be marked as a participant in the receive() function.