Christmas Dinner
First Flight #31
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Missing deadlineSet value update

leopoldflint

Summary

In this contract the function 'setDeadline', based on a logic, should be called once. But this function can be called several times.

Vulnerability Details

Location 2024-12-christmas-dinner/src/ChristmasDinner.sol at 9682dcc306db935a2511e1eb8280d17ef01e9004 · Cyfrin/2024-12-christmas-dinner · GitHub

To prevent this funciton from being executed again, a boolean variable 'deadlineSet' is needed. But its value is not updated.

function setDeadline(uint256 _days) external onlyHost {
if(deadlineSet) {
revert DeadlineAlreadySet();
} else {
deadline = block.timestamp + _days * 1 days;
emit DeadlineSet(deadline);
}
}

The 'host' can execute function 'setDeadline' several times.

Impact

This vulnerability can lead to manipulations by the 'host' in relation to the 'participants'. For example, prevent refund, by setting deadline a lower value.

Recommendations

Set 'deadlineSet' to true after 'deadline' is set.

function setDeadline(uint256 _days) external onlyHost {
if(deadlineSet) {
revert DeadlineAlreadySet();
} else {
deadline = block.timestamp + _days * 1 days;
deadlineSet = true;
emit DeadlineSet(deadline);
}
}

Also 'setDeadline' should be called from a constructor, as a deployer can probably forget to call it during initialisation at all.

Updates

Lead Judging Commences

0xtimefliez Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

deadline is never set to true

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!