Christmas Dinner
First Flight #31
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Malicious User Can Register with a Zero Balance

icon0x

Vulnerablity Details

The Deposit function allows malicious users to sign up for the event without contributing any funds. By setting their deposit amount to zero, they can bypass the payment requirement and still mark themselves as participants in the Christmas dinner event, despite making no financial contribution. This loophole enables users to attend the event for free, undermining the intended contribution system.

Impact

Users can attend the Christmas dinner party without paying, resulting in the host being short of funds needed to organize the event properly.

Proof of Concept

Add the below foundry test to the test file, to attest the validity of this finding.

function test_UserSignUpWithZeroValue() public {
vm.warp(1 + 3 days);
vm.startPrank(user1);
// user1 deposit zero wbtc token
cd.deposit(address(wbtc), 0);
// And still make it for the event.
assertEq(cd.getParticipationStatus(user1), true);
vm.stopPrank();
}

Recommended Mitigation

To address this issue, consider implementing a verification mechanism to ensure that no user can sign up without making a payment.

++ error AmountMustBeGreaterThanZero();
function deposit(address _token, uint256 _amount) external beforeDeadline {
++ if (_amount == 0) {
++ revert AmountMustBeGreaterThanZero();
++ }
// @audit: the deposit mechanism does not allow user to sign-up other users.
if (!whitelisted[_token]) {
revert NotSupportedToken();
}
if (participant[msg.sender]) {
balances[msg.sender][_token] += _amount;
IERC20(_token).safeTransferFrom(msg.sender, address(this), _amount);
emit GenerousAdditionalContribution(msg.sender, _amount);
} else {
participant[msg.sender] = true;
balances[msg.sender][_token] += _amount;
IERC20(_token).safeTransferFrom(msg.sender, address(this), _amount);
emit NewSignup(msg.sender, _amount, getParticipationStatus(msg.sender));
}
}
Updates

Lead Judging Commences

0xtimefliez Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Design choice

Appeal created

icon0x Submitter
about 1 year ago
0xtimefliez Lead Judge
about 1 year ago
0xtimefliez Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!