Vulnerability Details

The reentrancy protection in the contract is incorrectly implemented. The nonReentrant modifier never sets the lockedstate to true, making the reentrancy guard ineffective. After function execution, it unconditionally sets locked to false, defeating the purpose of the lock mechanism.

Impact - high

No Real Reentrancy Protection: refund function marked with nonReentrant is not actually protected.

Direct Fund Drain

• Attacker can repeatedly call refund() in a single transaction

• Each call gets ETH before balances are set to zero

This could lead to complete loss of deposited ETH in the Christmas Dinner contract.

Tools Used

Manual Review

Recommendations

before the function exectuion ,set the locked varibale to true (basically locking it )