Christmas Dinner
First Flight #31
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Denial of service: No deposited ETH balance checks, leading to gas exhaustion and making contract unusable

owanemi

Summary:

The refund() and internal _refundETH() function in the ChristmasDinner contract fails to validate refund eligibility, allowing addresses without a deposited ETH balance in the contract to waste gas from the contract without restrictions.

Vulnerability details

Both the internal _refundETH() and external refund() function does not check if the caller (msg.sender) is eligible for a refund. For example, if their deposited ETH balance is 0 they can unconditionally transfer 0 ETH based on the etherBalance mapping, which can waste a lot of gas.
as the EVM allows for 0 value ETH transfers.

Impact

When a malicious user without a deposited ETH balance keeps calling the contract's refund() function, the contract will keep sending 0 ether and can eventually run out of gas. Making the entire contract unusable

Tools Used

Manual Review, Foundry

Recommendations

in the refund() function add a check to ensure the refundee's deposited ETH balance is greater than 0

function refund() external nonReentrant beforeDeadline {
+ require(etherBalance[msg.sender] > 0, "no ether balance in contract");
address payable _to = payable(msg.sender);
_refundERC20(_to);
_refundETH(_to);
emit Refunded(msg.sender);
}
Updates

Lead Judging Commences

0xtimefliez Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!