Christmas Dinner

Summary

The contract purpose is to "force" the attendees to pay upon signup. However, users can use the function ChristmasDinner::changeParticipationStatus to become a participant without deposit.

Vulnerability Details

The function ChristmasDinner::changeParticipationStatus changes participation status to true for the msg.sender if it is false and deadline has not passed. However, this allows anyone to become a participant without a deposit, and that breaks the contract purpose.

Impact

Users can become participants without deposit, broking the contract purpose.

Tools Used

Manual review

Recommendations

Add another mapping to track who has deposited on sign up and check the mapping in the changeParticipationStatus function.