Christmas Dinner

Summary

The receive() function lacks the beforeDeadline modifier allowing users to send ETH after the registration deadline has passed, unlike other functions like deposit() which enforce this check. This creates an inconsistency in deadline enforcement between ETH and token deposits.

Vulnerability Details

The receive() function in the ChristmasDinner contract lacks the beforeDeadline modifier that is present in other participation functions like deposit(). This allows users to send ETH to the contract even after the registration deadline has passed.

Impact

1. Bypassing Deadline: Users can send ETH after the intended cutoff date

2. Inconsistent Behavior: Token deposits enforce deadline but ETH deposits don't

3. Compromised Control: Host loses ability to enforce strict registration deadlines

4. Event Planning Issues: Inability to finalize participant count by deadline

Tools Used

Manual Review

Recommendations

Add the beforeDeadline modifier to maintain consistent deadline checks across all participation methods.