Submission Details
Severity:
beforeDeadline modifier not in receive()
Summary
the beforeDeadline modifier is NOT used in receive() function when sending ETH to participate.
Impact
Users can bypass the deadline restriction by sending ETH directly
Creates unfairness between ERC20 depositors (who are restricted by deadline) and ETH depositors (who aren't)
Could disrupt event planning if people join after the intended cutoff
Tools Used
Recommendations
Fix Recommendation:
Add beforeDeadline modifier to the receive()
receive() external payable beforeDeadline {
etherBalance[msg.sender] += msg.value;
participant[msg.sender] = true;
emit NewSignup(msg.sender, msg.value, true);
}
or/and add a fallback function to prevent accidental ETH transfers through other means:
fallback() external payable {
revert("Use receive() to send ETH");
}
Updates
Lead Judging Commences
0xtimefliez 7 months ago
Submission Judgement Published Assigned finding tags:
receive() function independant from deadline
0xtimefliez 7 months ago
Submission Judgement Published Assigned finding tags:
receive() function independant from deadline
Rewards breakdown
nSLOC
129This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.