Christmas Dinner
First Flight #31
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

We do not change the participant status when users sign up with ether

jimpixjed

Summary

When ehter is sent to the contract address we do not change the staus of the sender to reflect that he is a participant in the event.

Vulnerability Details

When the receive function is called we do not set the status of the sender to a participant in the event. This contradicts the logic that we have in the deposit function and an user might sent funds and be marked as a 'Funder' when he/she actaully wants to be a 'Participant'.

Impact

User might not be signed up to attend the event when he/she actaully wants to attend it. In this case he/she has to manually change their status to attending, where as if they deposit a token they are automatically singed up.

Tools Used

  • Manual Review

  • Foundry Testing

POC

function test_depositEtherNoParticipantStatusChange() public {
address payable _cd = payable(address(cd));
vm.deal(user1, 10e18);
vm.prank(user1);
(bool sent, ) = _cd.call{value: 1e18}("");
require(sent, "transfer failed");
assertEq(user1.balance, 9e18);
assertEq(address(cd).balance, 1e18);
assertEq(cd.getEtherBalance(user1), 1e18);
// This is wrong, user status should be changed on deposit of ether to follow the same logic as 'deposit' function
assertEq(cd.getParticipationStatus(user1), false);
}

Recommendations

Change the status of the user to a participant when he/she sents ether to the contract.

receive() external payable {
etherBalance[msg.sender] += msg.value;
if (!participant[msg.sender]) {
participant[msg.sender] = true;
emit NewSignup(msg.sender, msg.value, getParticipationStatus(msg.sender));
} else {
emit GenerousAdditionalContribution(msg.sender, msg.value);
}
}
Updates

Lead Judging Commences

0xtimefliez Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

receive does not update participation status

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!