Christmas Dinner
First Flight #31
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

User can call `christmasDinner::refund` and still particpate in the event

nem0thefinder

Summary

A user can call christmasDinner::refund to retrieve their deposit but still participate in the event.
https://github.com/Cyfrin/2024-12-christmas-dinner/blob/9682dcc306db935a2511e1eb8280d17ef01e9004/src/ChristmasDinner.sol#L137

Vulnerability Details

When a user calls christmasDinner::refund, it sends the user all deposited amounts in various tokens. However, it does not update the user's participation status, allowing them to remain marked as a participant in the event despite receiving a refund.

PoC

  • use this test in christmasDinnerTest.t.sol`

function testUserRefundAndStillParticpateInEvent() public {
vm.prank(user1);
cd.deposit(address(weth),1e18);
assertEq(weth.balanceOf(user1), 9e18); // i changed user dealing amount in setup to 10e18
assertEq(weth.balanceOf(address(cd)), 1e18);
vm.prank(user1);
cd.refund();
assertEq(weth.balanceOf(user1), 10e18);
assertEq(weth.balanceOf(address(cd)), 0);
assertEq(cd.getParticipationStatus(user1),true);
​
}


Impact

  • A user can refund all their deposits and still participate in the event, potentially disrupting the event's integrity and fairness.

Tools Used

  • IDE

  • Manual Review

Recommendations

  • Update the user participation status to false after processing the refund to prevent participation after the refund is issued.

  • We can also add mapping to check whether user called refund or not and add it as check in changeParticipationStatus function

function refund() external nonReentrant beforeDeadline {
address payable _to = payable(msg.sender);
_refundERC20(_to);
_refundETH(_to);
+ participant[msg.sender] = false;
emit Refunded(msg.sender);
}
Updates

Lead Judging Commences

0xtimefliez Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

refund does not update participation status

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!