Christmas Dinner
First Flight #31
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Deadline can be manipulated indefinitely due to unset deadlineSet flag

0x180db

Summary

The contract includes a deadlineSet boolean flag to prevent multiple deadline changes, but the flag is never set to true. This oversight allows the host to change the deadline indefinitely, potentially manipulating the participation window and undermining the contract's time-bound guarantees.

Vulnerability Details

The setDeadline function checks the deadlineSet flag but never updates it:
ChristmasDinner.sol#L180-L187

function setDeadline(uint256 _days) external onlyHost {
if(deadlineSet) {
revert DeadlineAlreadySet();
} else {
deadline = block.timestamp + _days * 1 days;
emit DeadlineSet(deadline);
}
}

The deadlineSet variable is initialized as:
ChristmasDinner.sol#L42

bool public deadlineSet = false;

Impact

  • Host can repeatedly change the deadline

  • Undermines the contract's time-bound guarantees

  • Participants cannot rely on the deadline for planning

  • Could be used to manipulate participant behavior or prevent refunds

Tools Used

  • Manual code review

  • Performing formal verification with Quint

Recommendations

Set the deadlineSet flag to true after setting the deadline

Updates

Lead Judging Commences

0xtimefliez Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

deadline is never set to true

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!