Submission Details
Severity:
It is possible to attend the event for Free
Description:
In the ChristmasDinner::refund() there is no mechanism which changes the status of participants. As a result the participants are still be able to attend the event with zero contribution.
Impact:
When this bug is exploited by even few of the participants, the host will not be able to organise the event properly as the funds will not be enough to cover the event's expenses.
Proof of Concept:
Please this code in ChristmasDinnerTest.t.sol.
run the following command
forge test --mt test_refundButStatusNotChanged.
function test_refundButStatusNotChanged() public {
vm.startPrank(user1);
cd.deposit(address(wbtc), 1e18);
// the user ask for refund
cd.refund();
// after refund the user is still participant
assertEq(cd.getParticipationStatus(user1),true);
}
Recommended Mitigation:
function refund() external nonReentrant beforeDeadline {
...
+ participant[msg.sender] = false
emit Refunded(msg.sender);
}
Updates
Lead Judging Commences
0xtimefliez 11 months ago
Submission Judgement Published Assigned finding tags:
refund does not update participation status
Rewards breakdown
nSLOC
129This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.