Submission Details
Severity:
Missing check for participant in `ChristmasDinner:refund` function, lead to unnessasery gas used.
summary:
`ChristmasDinner::refund` function does not checks for participant before refund the funds to the user.
```javascript
function refund() external nonReentrant beforeDeadline {
@> address payable _to = payable(msg.sender);
_refundERC20(_to);
_refundETH(_to);
emit Refunded(msg.sender);
}
```
Impact:
Unnessesery gas is used to perform the refund task if the caller is not the participant.
Proof of concept:
Add these to `ChristmasDinnerTest.t.sol`
code:
```javascript
function testlossGas() public {
vm.txGasPrice(1);
address user = makeAddr("user");
uint256 gasBefore = gasleft();
vm.prank(user);
cd.refund();
uint256 gasAfter = gasleft();
assert(gasBefore > gasAfter);
console.log("Gas before: ", gasBefore);
console.log("Gas after: ", gasAfter);
console.log("Used gas:, ", gasBefore - gasAfter);
}
```
If `refund` function does not check participant before doing any stuff, The output of this test is:
```
gasBefore = 1073716296
gasAfter = 1073661511
gasDiffrence = 54785
```
After adding missing check the output will be :
```
gasBefore = 1073716296
gasAfter = 1073703811
gasDiffrence = 12485
```
Check the output by adding reccomended mitigation by this test
Code:
```javascript
function testlossGas() public {
vm.txGasPrice(1);
address user = makeAddr("user");
uint256 gasBefore = gasleft();
vm.prank(user);
vm.expectRevert();
cd.refund();
uint256 gasAfter = gasleft();
assert(gasBefore > gasAfter);
console.log("Gas before: ", gasBefore);
console.log("Gas after: ", gasAfter);
console.log("Used gas:, ", gasBefore - gasAfter);
}
```
Recomendation:
The function should be like this.
```diff
function refund() external nonReentrant beforeDeadline {
+ if(participant[msg.sender] == false) {
+ revert();
+ }
address payable _to = payable(msg.sender);
_refundERC20(_to);
_refundETH(_to);
emit Refunded(msg.sender);
}
```
Rewards breakdown
nSLOC
129This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.