Christmas Dinner
First Flight #31
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

After refund there is no validation present to make the refunded person out of the dinner participation list.

rhaosec

Summary

The current implementation of the refund function allows participants to receive refunds for their deposits before the deadline. However, the function lacks integration with any mechanism to update the participant’s status after a refund. Specifically:

  • After calling the refund function, a participant remains marked as active, allowing them to potentially exploit the system.

  • This omission enables refunded individuals to retain their status as participants, which can result in unjustified privileges (e.g., attending events like a dinner or remaining eligible for rewards).

Vulnerability Details

function refund() external nonReentrant beforeDeadline {
address payable _to = payable(msg.sender);
_refundERC20(_to);
_refundETH(_to);
emit Refunded(msg.sender);
}

Observe the refund function and there is no call to make the refunded participant out of the participation list for the dinner.

Impact

  • Refunded individuals can still attend events (e.g., dinners) without financial contribution, violating fairness and system rules.

  • Loss of funds: Hosts bear the cost of providing resources to non-contributing participants, causing monetary losses.

  • This vulnerability directly impacts financial sustainability, system integrity, and stakeholder confidence.

Tools Used

Manual

Recommendations

function refund() external nonReentrant beforeDeadline {
require(participant[msg.sender], "Not an active participant");
address payable _to = payable(msg.sender);
_refundERC20(_to);
_refundETH(_to);
+ participant[msg.sender] = false;
emit Refunded(msg.sender);
}
Updates

Lead Judging Commences

0xtimefliez Lead Judge 8 months ago
Submission Judgement Published
Validated
Assigned finding tags:

refund does not update participation status

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.