Christmas Dinner
First Flight #31
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Vulnerability in receive() Function: Missing Participant Status Update

architect

Summary

In the current implementation of the receive() function, when a user sends Ether to the contract, the participant mapping does not update the user's participation status to true. This omission prevents the contract from correctly tracking the user's participation in the event, despite the user sending Ether to join.

Vulnerability Details

The receive() function allows users to send Ether to the contract to participate in the event. However, while the Ether sent by the user is recorded in the etherBalance mapping, the participant mapping, which tracks whether a user is participating, is not updated. This means that users who send Ether to join the event will not be marked as participants, and as a result, they may be unable to access certain functionality intended for participants, such as receiving refunds or changing their participation status.

receive() external payable {
etherBalance[msg.sender] += msg.value;
emit NewSignup(msg.sender, msg.value, true);
}

Impact

The contract fails to update the participant mapping when users send Ether to join the event. As a result, users who contribute Ether are not correctly registered as participants, which may lead to issues such as:

  • Inability to change participation status.

  • Inability to receive a refund if they choose not to attend.

  • Lack of access to functionality meant for participants

Tools Used

Manual

Recommendations

To resolve this issue, the contract should update the participant mapping when a user sends Ether, marking them as a participant. Additionally, emitting an event to confirm the update would provide a more transparent mechanism for tracking participants.

receive() external payable {
etherBalance[msg.sender] += msg.value;
participant[msg.sender] = true; // Mark the user as a participant
emit NewSignup(msg.sender, msg.value, true);
}
Updates

Lead Judging Commences

0xtimefliez Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

receive does not update participation status

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!