Christmas Dinner
First Flight #31
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Participant Status Set Before Successful Token Transfer

0xmaxi

Summary

The deposit function in the ChristmasDinner contract sets a user's participant status to true before verifying that the token transfer was successful. This could lead to users being registered as participants even if their token transfer fails.

Vulnerability Details

In the deposit function, when a new participant attempts to join, the following sequence occurs:

  1. The participant status is set to true

  2. The balance is updated

  3. The token transfer is attempted
    It can be seen here

​
function deposit(address _token, uint256 _amount) external beforeDeadline {
// ......
} else {
participant[msg.sender] = true; // Status set before transfer
balances[msg.sender][token] += _amount;
IERC20(token).safeTransferFrom(msg.sender, address(this), _amount); // Could fail
emit NewSignup(msg.sender, amount, getParticipationStatus(msg.sender));
}

If the safeTransferFrom call fails (e.g., due to insufficient allowance or balance), the transaction will revert, but in a scenario where the contract is called by another contract that catches the revert, the participant status could remain set without any actual deposit.

Impact

  • Users could be registered as participants without making any deposit

  • This could lead to inaccurate participant counting

  • Could potentially allow participation in event coordination without financial commitment

Tools Used

  • Manual review

Recommendations

Implement Checks-Effects-Interactions pattern by moving the state changes after the token transfer:

​
function deposit(address _token, uint256 _amount) external beforeDeadline {
// ...
else {
IERC20(token).safeTransferFrom(msg.sender, address(this), _amount);
participant[msg.sender] = true;
balances[msg.sender][token] += _amount;
emit NewSignup(msg.sender, amount, getParticipationStatus(msg.sender));
}
}
Updates

Lead Judging Commences

0xtimefliez Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.