Christmas Dinner
First Flight #31
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Unauthorized Token Refunds Due to Missing Balance Validation

0xmaxi

Summary

The _refundERC20() function in the ChristmasDinner contract allows any address to request token refunds without validating whether they have deposited any tokens or are registered participants, potentially enabling unauthorized withdrawals.

Vulnerability Details

The _refundERC20() function is called internally by the refund() function and attempts to transfer WETH, WBTC, and USDC tokens to the requesting address without any validation:

function _refundERC20(address _to) internal {
// No Balance validation
i_WETH.safeTransfer(_to, balances[_to][address(i_WETH)]);
i_WBTC.safeTransfer(_to, balances[_to][address(i_WBTC)]);
i_USDC.safeTransfer(_to, balances[_to][address(i_USDC)]);
balances[_to][address(i_USDC)] = 0;
balances[_to][address(i_WBTC)] = 0;
balances[_to][address(i_WETH)] = 0;
}

Key issues:

  • Missing input validation that the address requesting refund is a registered participant

  • No checks that the address has any token balances to refund

Impact

While the actual token transfers would revert for zero balances due to the use of safeTransfer, this represents an access control risk as any address can trigger refund attempts

Tools Used

  • Manual code review

Recommendations

Add participant validation by requiring them to be tracked in the participantmapping.

function _refundERC20(address _to) internal {
require(participant[to], "Not a participant");
i_WETH.safeTransfer(_to, balances[_to][address(i_WETH)]);
i_WBTC.safeTransfer(_to, balances[_to][address(i_WBTC)]);
i_USDC.safeTransfer(_to, balances[_to][address(i_USDC)]);
balances[_to][address(i_USDC)] = 0;
balances[_to][address(i_WBTC)] = 0;
balances[_to][address(i_WETH)] = 0;
}
Updates

Lead Judging Commences

0xtimefliez Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.