Christmas Dinner
First Flight #31
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

User Can Sign-up Through Depositing Zero Ether

icon0x

Vulnerability Details

The purpose of the christmasDinner contract, as stated in the ReadMe.md file, is to address funding security for social events by requiring attendees to pay upon signup, ensuring the host can plan with a clear budget after the deadline. However, a malicious user could sign up for the event by depositing zero ether, effectively making no payment at all.

Impact

Malicious user sign-up without making payment.

Proof of concept

  • Let's assume receive function used to sign-up via ether update the Participant statue correct

receive() external payable {
+ participant[msg.sender] = true;
etherBalance[msg.sender] += msg.value;
emit NewSignup(msg.sender, msg.value, true);
}

  • Then, add the below foundry test to the ChristmasDinner.t.sol file:

function test_depositZeroEtherToSignUp() public {
address payable _cd = payable(address(cd));
vm.prank(user1);
(bool sent,) = _cd.call{value: 0}("");
require(sent, "transfer failed");
assertEq(cd.getParticipationStatus(user1), true);
}

Expected Output:

Ran 1 test for test/ChristmasDinnerTest.t.sol:ChristmasDinnerTest
[PASS] test_depositZeroEtherToSignUp() (gas: 38277)
Suite result: ok. 1 passed; 0 failed; 0 skipped; finished in 2.45ms (159.90µs CPU time)
​

Recommended Mitigation

To fix this issue, consider the below updated code:

+ error AmountMustBeGreaterThanZero();
receive() external payable {
+ if (msg.value == 0) {
+ revert AmountMustBeGreaterThanZero();
+ }
participant[msg.sender] = true;
etherBalance[msg.sender] += msg.value;
emit NewSignup(msg.sender, msg.value, true);
}
Updates

Lead Judging Commences

0xtimefliez Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Design choice

Appeal created

icon0x Submitter
about 1 year ago
0xtimefliez Lead Judge
about 1 year ago
0xtimefliez Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!