Submission Details
Severity:
Ability To Attend Event After Refund
Summary
User's are still able to attend the event even after a full refund on their deposit.
Vulnerability Details
A user is able to call deposit() to signup for the event, then immediately call refund() to collect their funds. This however, does not impact the user's particpation status which was set to true in deposit() but never updated to false after the call to refund().
Impact
This means that users will be able to attend the event for free.
Tools Used
Manual review.
Recommendations
Update the refund() function to change the caller's participation status from true to false.
Updates
Lead Judging Commences
0xtimefliez about 1 year ago
Submission Judgement Published Assigned finding tags:
refund does not update participation status
Rewards breakdown
nSLOC
129This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.