Submission Details
Severity:
Signing up using ether doesn't update participation status
Summary
When a user signs up by depositing ethers, their participation status is not updated.
Vulnerability Details
A user can signup using ether by directly sending ether to ChristmasDinner contract. This would trigger the receive() function. It takes the deposit amount and updates the deposit mapping, but it does not update the participation status.
receive() external payable {
etherBalance[msg.sender] += msg.value;
emit NewSignup(msg.sender, msg.value, true);
}
Impact
This would let the host not being able to prepare properly for the exact number of participants.
Tools Used
Manual, VSCode
Recommendations
Make the following changes in receive() function
receive() external payable {
+ participant[msg.sender] = true;
etherBalance[msg.sender] += msg.value;
emit NewSignup(msg.sender, msg.value, true);
}
Updates
Lead Judging Commences
0xtimefliez about 1 year ago
Submission Judgement Published Assigned finding tags:
receive does not update participation status
Rewards breakdown
nSLOC
129This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.