Christmas Dinner
First Flight #31
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Missing deadline check in receive() function leads to permanent fund lock

0x180db

Summary

The contract's receive() function accepts Ether deposits at any time, but the refund() function is restricted by the beforeDeadline modifier. This mismatch creates a situation where users can deposit Ether after the deadline but cannot retrieve it.

Vulnerability Details

  1. The receive() function lacks the beforeDeadline modifier:
    ChristmasDinner.sol#L205

receive() external payable {
...
}

  1. While the refund() function has the modifier:
    ChristmasDinner.sol#L137

function refund() external nonReentrant beforeDeadline {
...
}

Impact

  • Users can permanently lose funds by sending Ether to the contract after the deadline

  • No mechanism exists to recover these trapped funds

Tools Used

  • Manual code review

  • Performing formal verification with Quint

Recommendations

  • Add the beforeDeadline modifier to the receive() function.

Updates

Lead Judging Commences

0xtimefliez Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

receive() function independant from deadline

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!