Christmas Dinner
First Flight #31
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Premature fund withdrawal by host prevents participant refunds

0x180db

Summary

The withdraw() function lacks timing constraints, allowing the host to withdraw all funds at any time. This can prevent participants from getting refunds before the deadline, violating the contract's intended functionality of allowing refunds until the deadline.

Vulnerability Details

The current withdraw() function has no deadline checks:
ChristmasDinner.sol#L194

function withdraw() external onlyHost {
...
}

Impact

  • Host can withdraw funds before the deadline

  • Participants lose their right to refund before deadline

  • Breaks the trust mechanism built into the contract

  • Violates the core business logic of the contract

Tools Used

  • Manual code review

  • Performing formal verification with Quint

Recommendations

Add an afterDeadline modifier and apply it to the withdraw() function:

modifier afterDeadline() {
if(block.timestamp <= deadline) {
revert BeforeDeadline();
}
_;
}
Updates

Lead Judging Commences

0xtimefliez Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

withdraw is callable before deadline ends

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!