Christmas Dinner
First Flight #31
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

ChristmasDinner::withdraw allows the host to withdraw funds before the deadline, potentially preventing participants from refunding.

chllinx

Summary

The ChristmasDinner::withdraw function does not check the deadline, allowing the host to withdraw funds before the deadline, which could affect participants' ability to refund and compromise the fairness of the contract.

Vulnerability Details

In the ChristmasDinner::withdraw function, there is no deadline check, allowing the host to withdraw funds before the deadline. If the host withdraws funds before the deadline, participants may not be able to perform refund operations, leading to incomplete contract functionality and negatively impacting participants' interests and the fairness of the contract.

Impact

  • Affects participant refunds: The host withdrawing funds before the deadline could prevent participants from refunding, which jeopardizes their financial security.

  • Abuse of power: Allowing the host to withdraw funds at an inappropriate time could be abused, providing the host with an unfair advantage.

  • Incomplete contract functionality: The contract fails to restrict fund withdrawals as expected, affecting its predictability and fairness.

Tools Used

Manual review.

Recommendations

Add a deadline check in the withdraw function to ensure the host can only withdraw funds after the deadline.

function refund() external nonReentrant beforeDeadline {
address payable _to = payable(msg.sender);
_refundERC20(_to);
_refundETH(_to);
emit Refunded(msg.sender);
}
​
function withdraw() external onlyHost {
+ require(block.timestamp > deadline, "Cannot withdraw before the deadline");
​
address _host = getHost();
i_WETH.safeTransfer(_host, i_WETH.balanceOf(address(this)));
i_WBTC.safeTransfer(_host, i_WBTC.balanceOf(address(this)));
i_USDC.safeTransfer(_host, i_USDC.balanceOf(address(this)));
}
Updates

Lead Judging Commences

0xtimefliez Lead Judge 11 months ago
Submission Judgement Published
Validated
Assigned finding tags:

withdraw is callable before deadline ends

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.