Christmas Dinner

First Flight #31
Beginner FriendlyFoundrySolidity
100 EXP
View results
Submission Details
Severity: medium
Valid

The `ChristmasDinner::refund` function does not update the `participant` mapping, allowing users to participate even if they already received a refund.

Description

The ChristmasDinner::refund function never updates the participant mapping of the user requesting the refund.

Impact

One impactul scenario is when users who have already requested a refund may still attend the dinner for free.

Proof of Concepts

Recommended mitigation

Add the following change to the code.

function refund() external nonReentrant beforeDeadline {
+ participant[msg.sender] = false;
address payable _to = payable(msg.sender);
_refundERC20(_to);
_refundETH(_to);
emit Refunded(msg.sender);
}
Updates

Lead Judging Commences

0xtimefliez Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

refund does not update participation status

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.