Vulnerability Details
This vulnerability arises when a non-participant of the Christmas dinner party calls the changeParticipationStatus function. This function is intended to update the status of valid participants who are no longer attending the event and treat their deposited funds as a donation.
Here is the vulnerable code:
function changeParticipationStatus() external {
if (participant[msg.sender]) {
participant[msg.sender] = false;
@> } else if (!participant[msg.sender] && block.timestamp <= deadline) {
@> participant[msg.sender] = true;
} else {
revert BeyondDeadline();
}
emit ChangedParticipation(msg.sender, participant[msg.sender]);
}
Impact
The host may face a shortage of funds to effectively organize the Christmas event due to some participants bypassing the sign-up fee.
Proof of Concept
Add the below foundry test to test file to attest to this vulnerability.
function test_UserChangeParticipationTrueWithoutPaying() public {
vm.startPrank(user1);
bool userParticipationStatusBefore = cd.getParticipationStatus(user1);
console.log(" User Participation status before: ", userParticipationStatusBefore);
cd.changeParticipationStatus();
bool userParticipationStatusAfter = cd.getParticipationStatus(user1);
console.log(" User Participation status after: ", userParticipationStatusAfter);
assertEq(cd.getParticipationStatus(user1), true);
}
Output
[PASS] test_UserChangeParticipationTrueWithoutPaying() (gas: 44664)
Logs:
User Participation status before: false
User Participation status after: true
Suite result: ok. 1 passed; 0 failed; 0 skipped; finished in 4.11ms (887.00µs CPU time)
Recommended Mitigation
Consider adding a check effect to ensure msg.sender contribution is greater than zero to mitigate this issue.
- function changeParticipationStatus() external {
+ function changeParticipationStatus(address _token) external {
if (participant[msg.sender]) {
participant[msg.sender] = false;
- } else if (!participant[msg.sender] && block.timestamp <= deadline) {
+ } else if (!participant[msg.sender] && block.timestamp <= deadline && (etherBalance[msg.sender] > 0 || balances[msg.sender][_token] > 0)) {
participant[msg.sender] = true; // @audit malicious user could sign-up without making payment.
} else {
revert BeyondDeadline();
}
emit ChangedParticipation(msg.sender, participant[msg.sender]);
}
