Christmas Dinner
First Flight #31
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Centralisation on the Host and can change its participation to be out of the event

elooo

Summary

The change host function check if the new host is a participant when changing hosts , but doesn't prevent the host from later changing their participation status to false. This could lead to a situation where the host is no longer participating, but also can leave with the funds.

Vulnerability Details

  • Lack of invariant that host must always be a participant, if we have a malicious participant that participate for 0 and then take the host of the event and go with the funds.

  • No checks in withdraw() function to verify host is still participating

Impact

Host could withdraw all funds whil not participating to the event, he has access to withdraw() function to take all the funds. The host can still control funds even after opting out and there is no mechanism to recover funds if host withdraw and leaves.

Tools Used

Recommendations

Add a host status checks, prevent host from leaving while being host on the function changeParticipationStatus , and force host to transfer role before leaving.

Also secure the withdraw function and add multisig - I would recommand to have more thant one host , at least 2 or 3 to ensure that the dinner is properly organized :D we want the christmas Dinner to be perfect !

modifier onlyHost() {
if(msg.sender != host || !participant[msg.sender]) {
revert NotHost();
}
_;
}
​
function changeParticipationStatus() external {
require(msg.sender != host, "Host cannot opt out. Transfer host role first");
....
}
​
function changeHost(address _newHost) external onlyHost {
require(_newHost != address(0), "Zero address not allowed");
require(_newHost != host, "Already the host");
.....
host = _newHost;
emit NewHost(host);
​
}
Updates

Lead Judging Commences

0xtimefliez Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Host can be non-participant

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.