Submission Details
Severity:
Missing Participation Status Update for user who deposited through Ether.
Vulnerability Details
This issue occurs as the system fails to record the participation status of users who make deposits using Ether. As a result, their contributions are not properly acknowledged, potentially causing discrepancies in tracking.
Here is the vulnerable code:
receive() external payable {
// @audit missing participation status.
etherBalance[msg.sender] += msg.value;
emit NewSignup(msg.sender, msg.value, true);
}
Impact
Users who deposit via Ether risk losing access to attend the Christmas event, resulting in potential loss of funds.
Proof of Concept
Add the below foundry test to the test file:
function test_EtherParticipantDenialAccess() public {
address payable _cd = payable(address(cd));
vm.deal(user1, 10e18);
vm.prank(user1);
(bool sent,) = _cd.call{value: 1e18}("");
require(sent, "transfer failed");
uint256 cdBalance = address(cd).balance;
console.log("cd Balance: ", cdBalance);
// check the user participation status
bool userParticipationStatus = cd.getParticipationStatus(user1);
console.log("User Participation Status: ", userParticipationStatus);
assertEq(userParticipationStatus, false);
}
Output
Ran 1 test for test/ChristmasDinnerTest.t.sol:ChristmasDinnerTest
[PASS] test_EtherParticipantDenialAccess() (gas: 49255)
Logs:
cd Balance: 1000000000000000000
User Participation Status: false
Suite result: ok. 1 passed; 0 failed; 0 skipped; finished in 19.14ms (5.82ms CPU time)
Tools used
manual review.
Recommended Mitigation
To mitigate this issue consider updating the user participation status in the receive function
receive() external payable { /
++ participant[msg.sender] = true;
etherBalance[msg.sender] += msg.value;
emit NewSignup(msg.sender, msg.value, true);
}
Updates
Lead Judging Commences
0xtimefliez about 1 year ago
Submission Judgement Published Assigned finding tags:
receive does not update participation status
Rewards breakdown
nSLOC
129This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.