Christmas Dinner
First Flight #31
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Participant Signup Allowed Without Making Deposit

jporter

Summary

Participants are able to signup for the event without making any deposit.

Vulnerability Details

The changeParticipationStatus() function allows individuals to signup (by setting their participation status to true) without making a deposit. This is because the else if statement just checks to see if the caller's status is currently false and if the deadline has passed. Since participant is a mapping(address => boolean)the default boolean value for any address will be false. This will allow any new callers to satisfy the first check !participant[msg.sender]. As long as the deadline has not passed the second check will also be satisfied resulting in the expression returning true. This will then allow the caller to set their particpation status to true while bypassing the deposit() function.

Impact

This will allow users to attend the event while not having to pay.

Tools Used

Foundry test:

function test_changeParticipationWithNoDeposit() public {
vm.startPrank(user1);
assertEq(cd.getParticipationStatus(user1), false);
cd.changeParticipationStatus();
assertEq(cd.getParticipationStatus(user1), true);
}

Recommendations

Update the else if statment such that it verifies that the caller had previously made a deposit before changing their status from false back to true.

Updates

Lead Judging Commences

0xtimefliez Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

usage of change participation logic circumvents deposit

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!