Christmas Dinner
First Flight #31
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Users who deposit Ether do not become participants

yoanyjd

Summary

In the current implementation of the ChristmasDinner contract, users who deposit Ether through the receive() function are not automatically marked as participants. This issue arises because the receive() function does not call the logic that registers the user as a participant

Vulnerability Details

The contract contains a receive() function that handles Ether depositsр however, when Ether is sent to the contract, it does not trigger the participant registration logic, which is only triggered by ERC20 token deposits in the deposit() function. As a result, users who send Ether to the contract are not added to the participant mapping, meaning they are not recognized as participants in the event.

receive() external payable {
etherBalance[msg.sender] += msg.value; // not making the user a participiant
emit NewSignup(msg.sender, msg.value, true);
}

Impact

Users who deposit Ether into the contract will not automatically become participants. As a result, they will not be able to attend the event or interact with the event in any capacity. Additionally, these users will not have the ability to become hosts later, as the contract fails to register them as participants upon Ether deposit. This prevents them from fully engaging with the event and receiving any benefits associated with participation, including hosting privileges.

Tools Used

Manual code review

Recommendations

To fix this issue, the receive() function should include logic that marks users as participants when they deposit Ether.

receive() external payable {
etherBalance[msg.sender] += msg.value;
// adding the user as a participiant
if (!participant[msg.sender]) {
participant[msg.sender] = true;
}
emit NewSignup(msg.sender, msg.value, true);
}
Updates

Lead Judging Commences

0xtimefliez Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

receive does not update participation status

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!