Christmas Dinner
First Flight #31
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Anyone can become participant even without depositing any funds

joesepherus

Description: Using the ChristmasDinner::changeParticipationStatus function anyone can become a participant even without depositing any funds to the contract, until the deadline is not passed yet.

Impact: Anyone can become a participant and attend the event without depositing

Proof of Concept:

  1. User calls ChristmasDinner::changeParticipationStatus before the deadline

  2. User is a participant now

PoC Code

Add following test:

​
function test_becomeParticipantWithoutDeposit() public {
vm.startPrank(user1);
assertEq(cd.getParticipationStatus(user1), false);
cd.changeParticipationStatus();
assertEq(cd.getParticipationStatus(user1), true);
}
​

Recommendation: Check in the function ChristmasDinner::changeParticipationStatus if the user has any funds in the contract, to see if he has deposited any funds before. Only after the check change the users participant status to true.

Updates

Lead Judging Commences

0xtimefliez Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

usage of change participation logic circumvents deposit

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.