Christmas Dinner
First Flight #31
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

ETH funds will be stuck in the contract after the deadline

silverologist

Summary

Before the deadline, participants can request a refund for the ETH they contributed for the dinner.

However, after the deadline, participants can no longer claim refunds, and the host cannot withdraw the ETH.

As a result, any ETH remaining in the contract at the time of the deadline will be effectively locked within the contract (unless the deadline is updated).

Vulnerability Details

After the deadline the participants cannot get a refund:

function refund() external nonReentrant beforeDeadline { // @audit -- beforeDeadline is used

The host can only withdraw token funds:

function withdraw() external onlyHost {
address _host = getHost();
i_WETH.safeTransfer(_host, i_WETH.balanceOf(address(this)));
i_WBTC.safeTransfer(_host, i_WBTC.balanceOf(address(this)));
i_USDC.safeTransfer(_host, i_USDC.balanceOf(address(this)));
// @audit -- missing ETH withdrawal!
}

The deadline can be updated at anytime since DinnerChristmas::deadlineSet is never set to true. Updating the deadline will allow the ETH senders to request a refund for their ETH, however it will still not enable the host to withdraw the ETH.

Additionally, it is unclear whether it should be allowed for the deadline to be changed after it is initially set, as the contract defines a ChristmasDinner:DeadlineAlreadySet error, implying that after the first ChrismasDeadline::setDeadline call, ChristmasDeadline::deadlineSet should be set to true.

function setDeadline(uint256 _days) external onlyHost {
if (deadlineSet) {
revert DeadlineAlreadySet();
}

Impact

If any ETH is present in the contract when the deadline is reached, it will be unretrievable unless the deadline is updated.

Tools Used

Recommendations

In ChristmasDinner::withdraw, implement the withdrawal of ETH funds by the host.

Set ChrismasDinner::deadlineSet flag to true in ChristmasDinner::setDeadline if the deadline should not be allowed updates.

Updates

Lead Judging Commences

0xtimefliez Lead Judge 11 months ago
Submission Judgement Published
Validated
Assigned finding tags:

withdraw function lacks functionality to send ether

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.