Submission Details
Severity:
Ether Deposit Does Not Update Participation Status in Smart Contract
Vulnerability Details
The smart contract allows participants to deposit Ether but fails to ensure that this action updates their participation status. As a result, users who deposit Ether do not automatically become participants, leading to an inconsistency in the expected functionality.
Impact
Logical Inconsistency:
The contract does not align with the likely intended behavior, which is to link deposits with participation.
Tools Used
Manual Review , VS Code, Foundry
POC
function test_depositEtherDoesNotMakeParticipants() public {
address ethDepositor = makeAddr("etherDepositor");
vm.deal(ethDepositor, 1e18);
vm.startPrank(ethDepositor);
(bool sent,) = address(cd).call{value: 1e18}("");
require(sent, "transfer failed");
vm.stopPrank();
vm.prank(ethDepositor);
// after depositing eth depositor can not become participant
assert(!cd.getParticipationStatus(ethDepositor));
}
parwej@90CXC:/mnt/d/my Docs/2024-12-christmas-dinner$ forge test --mt test_depositEtherDoesNotMakeParticipants
[⠊] Compiling...
[⠑] Compiling 2 files with Solc 0.8.28
[⠘] Solc 0.8.28 finished in 588.99ms
Compiler run successful!
Ran 1 test for test/ChristmasDinnerTest.t.sol:ChristmasDinnerTest
[PASS] test_depositEtherDoesNotMakeParticipants() (gas: 44653)
Suite result: ok. 1 passed; 0 failed; 0 skipped; finished in 700.57µs (77.42µs CPU time)
Ran 1 test suite in 3.42ms (700.57µs CPU time): 1 tests passed, 0 failed, 0 skipped (1 total tests)
Recommendations
Update status of participant mapping of user in receive function
receive() external payable {
etherBalance[msg.sender] += msg.value;
+ participant[msg.sender] = true;
emit NewSignup(msg.sender, msg.value, true);
}
Updates
Lead Judging Commences
0xtimefliez about 1 year ago
Submission Judgement Published Assigned finding tags:
receive does not update participation status
Rewards breakdown
nSLOC
129This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.