Christmas Dinner
First Flight #31
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Withdraw can be called by multiple hosts before deadline

jimpixjed

Summary

The withdraw function can be called by multiple hosts, in the case where there are multiple changes of the host before the deadline of the event funding.

Vulnerability Details

Thsi vulnerability makes it so the funds of the event could be split up amoung multiple people and then each host needs to transfer the funds that were withdrawn to the next person when a change of host takes place.

​
function withdraw() external onlyHost {
address _host = getHost();
i_WETH.safeTransfer(_host, i_WETH.balanceOf(address(this)));
i_WBTC.safeTransfer(_host, i_WBTC.balanceOf(address(this)));
i_USDC.safeTransfer(_host, i_USDC.balanceOf(address(this)));
}

Impact

The contract might not have all of the funds in it invested by users if any of the old hosts has withdrawn funds before chaning ownership of the event. This would mean if the expenses for the event requier some of the funds that were already withdrawn the previos owner has to transfer them to the latest owner.

Tools Used

  • Manual review

Recommendations

If no upfront payment is requiered we can add a modifier that allows the funds to be withdrawn only after the deadline period has passed.

modifier afterDeadline() {
if (block.timestamp <= deadline) {
revert DeadlineNotReached();
}
_;
}

If that is not the case then we don't have much we can do as the current host might have withdrawn the funds and transfered them to another wallet already.

Updates

Lead Judging Commences

0xtimefliez Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

withdraw is callable before deadline ends

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!