Christmas Dinner
First Flight #31
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Unrestricted Participation Status Changes Inflates Number of Actual Participants

0xmaxi

Summary

The changeParticipationStatus() function allows any address to set themselves as a participant without requiring any deposit or contribution. This could lead to inaccurate participant tracking and potential disruption of the event planning.

Vulnerability Details

The vulnerability in this function allows anyone to be a participant without any financial commitment to the Dinner. It allows anyone to change their participant status to true without contributing money.

function changeParticipationStatus() external {
if(participant[msg.sender]) {
participant[msg.sender] = false;
@> } else if(!participant[msg.sender] && block.timestamp <= deadline) {
@> participant[msg.sender] = true;
} else {
revert BeyondDeadline();
}
emit ChangedParticipation(msg.sender, participant[msg.sender]);
}

Impact

  • Anyone can become a participant without financial commitment

  • Could lead to inflated participant numbers

  • May disrupt event planning and resource allocation

  • Host might make decisions based on incorrect participation data

Tools Used

Manual Review

Recommendations

Implement a mechanism to check if the caller of this function has any balance in the protocol before changing their participation status.

function changeParticipationStatus() external {
if(participant[msg.sender]) {
participant[msg.sender] = false;
} else if(!participant[msg.sender] && block.timestamp <= deadline) {
// Check if user has any balance before allowing participation
bool hasBalance = etherBalance[msg.sender] > 0 ||
balances[msg.sender][address(i_WETH)] > 0 ||
balances[msg.sender][address(i_WBTC)] > 0 ||
balances[msg.sender][address(i_USDC)] > 0;
require(hasBalance, "Must contribute to participate");
participant[msg.sender] = true;
} else {
revert BeyondDeadline();
}
emit ChangedParticipation(msg.sender, participant[msg.sender]);
}

The fix adds a balance check before allowing an address to become a participant. This ensures that only addresses that have contributed (either through ETH or whitelisted tokens) can participate in the event. The participation status can still be changed to false without restrictions, allowing people to withdraw from the event if needed.

Updates

Lead Judging Commences

0xtimefliez Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

usage of change participation logic circumvents deposit

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.