Christmas Dinner
First Flight #31
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Participation status can be manipulated without deposits leading to inconsistent participant tracking

0x180db

Summary

The contract allows addresses to change their participation status through changeParticipationStatus() without requiring any deposits. This creates a discrepancy between actual contributors and registered participants, potentially disrupting event planning and participant tracking.

Vulnerability Details

The changeParticipationStatus() function allows status changes without checking for deposits:
ChristmasDinner.sol#L148-L157

function changeParticipationStatus() external {
if(participant[msg.sender]) {
participant[msg.sender] = false;
} else if(!participant[msg.sender] && block.timestamp <= deadline) {
participant[msg.sender] = true;
} else {
revert BeyondDeadline();
}
emit ChangedParticipation(msg.sender, participant[msg.sender]);
}

Impact

  • Anyone can register as a participant without financial commitment

  • Inaccurate participant count for event planning

  • Host cannot rely on participant list for actual attendee count

  • Could lead to resource allocation issues for the event

Tools Used

  • Manual code review

  • Performing formal verification with Quint

Recommendations

Add deposit verification before allowing participation status changes:

function changeParticipationStatus() external {
bool hasDeposits = etherBalance[msg.sender] > 0;
// Check ERC20 balances
hasDeposits = hasDeposits ||
balances[msg.sender][address(i_WETH)] > 0 ||
balances[msg.sender][address(i_WBTC)] > 0 ||
balances[msg.sender][address(i_USDC)] > 0;
if(participant[msg.sender]) {
participant[msg.sender] = false;
} else if(!participant[msg.sender] && block.timestamp <= deadline) {
require(hasDeposits, "Must deposit to participate");
participant[msg.sender] = true;
} else {
revert BeyondDeadline();
}
emit ChangedParticipation(msg.sender, participant[msg.sender]);
}
Updates

Lead Judging Commences

0xtimefliez Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

usage of change participation logic circumvents deposit

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!