Christmas Dinner

Summary

The Host can prevent participants who deposited in various ERC20 tokens from refunding their deposits.
https://github.com/Cyfrin/2024-12-christmas-dinner/blob/9682dcc306db935a2511e1eb8280d17ef01e9004/src/ChristmasDinner.sol#L194
https://github.com/Cyfrin/2024-12-christmas-dinner/blob/9682dcc306db935a2511e1eb8280d17ef01e9004/src/ChristmasDinner.sol#L137

Vulnerability Details

When the host calls the christmasDinner::withdraw function, it will wipe the contract's balance in different tokens. Consequently, when a user attempts to refund their deposit, the transaction will revert because the contract has no tokens left.

PoC

• use this test in christmasDinnerTest.t.sol

  ​

  function testHostCanPreventUsersFromRefunding() public {

  vm.prank(user1);

  cd.deposit(address(usdc),1e18);

  vm.prank(user2);

  cd.deposit(address(weth),1e18);

  assertEq(usdc.balanceOf(address(cd)),1e18);

  assertEq(weth.balanceOf(address(cd)),1e18);

  vm.warp(2 days);

  // user 1 after 2 days want to refund his deposit but he can't

  // Because deployer withdraw all tokens

  vm.prank(deployer);

  cd.withdraw();

  vm.expectRevert();

  vm.prank(user1);

  cd.refund();

  ​

  }

Impact

• Users cannot claim refunds using the christmasDinner::refund function and recover their deposits.

Tools Used

• IDE

• Manual Review

Recommendations

• The christmasDinner::withdraw function should only be callable after the deadline has passed.