Christmas Dinner

Summary

The changeParticipationStatus function in the ChristmasDinner contract allows users to toggle their participation status without any access control mechanisms, allowing any address to modify their participation status.

Vulnerability Details

The changeParticipationStatus function:

The function is vulnerable because:

• No access control: The function does not verify whether the sender is already a participant. As a result, non-participants can also call this function and toggle their participation status to true before the event deadline.

• Lack of authorization: Anyone, including non-participants, can change their status, which can lead to unauthorized changes in the event's participation list.

Impact

An attacker could potentially call the changeParticipationStatus function and modify their participation status, even if they aren't a legitimate participant.

This issue enables malicious users to:

• Non-participants can join the event: They can call the changeParticipationStatus function and mark themselves as participants, even if they have not signed up or contributed any funds.

• Potential for unauthorized participation: This could affect the integrity of the event, allowing random or unauthorized participants to be included, altering event planning and contributions.

Tools Used

Manually source code review

Recommendations

To fix this issue, you should implement access control mechanisms to ensure that only users who are already participants can modify their participation status.

1. Create a modifier to ensure that only participants can change their participation status:

   modifier onlyParticipants() {

   require(participant[msg.sender], "Not a participant");

   _;

   }

2. Apply the modifier to the changeParticipationStatus function:

   function changeParticipationStatus() external onlyParticipants {

   if(participant[msg.sender]) {

   participant[msg.sender] = false;

   } else if(block.timestamp <= deadline) {

   participant[msg.sender] = true;

   } else {

   revert BeyondDeadline();

   }

   emit ChangedParticipation(msg.sender, participant[msg.sender]);

   }

   ​

3. This modification ensures that only users who are participants (i.e., users who have signed up or contributed) can call this function.