Christmas Dinner

Summary

The ChristmasDinner contract includes a setDeadline function to enforce a deadline for deposits and participant sign-ups. However, the contract does not set an initial value for the deadline in the constructor, and the setDeadline function must be explicitly called by the host to define the deadline. If the host forgets to set the deadline, the beforeDeadline modifier will never revert, allowing deposits indefinitely.

Vulnerability Details

The issue arises in the setDeadline function and its interaction with the beforeDeadline modifier

Modifier Definition

The deadline variable is initialized to 0 in the constructor and remains unset until the host explicitly calls setDeadline.

Without setting the deadline, the beforeDeadline modifier checks block.timestamp > deadline, which will always evaluate to false when deadline is 0.

This effectively disables the deadline enforcement, allowing users to deposit funds at any time.

Impact

Users can bypass the intended deadline restriction and deposit tokens indefinitely, which undermines the contract’s logic.

Tools Used

Manual

Recommendations

1. Initialize a Default Deadline in the Constructor

Set a reasonable default deadline during contract deployment to ensure the beforeDeadline modifier functions correctly even if the host forgets to call setDeadline.