Christmas Dinner
First Flight #31
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

A malicious host can reduce the deadline arbitrarily to lock out participants from refunding their deposits

0xalipede

Summary

In the ChristmasDinner::setDeadline function a malicious host can reduce the deadline arbitrarily to lock out participants from refunding their deposits.

Vulnerability Details

In the ChristmasDinner::setDeadline function, a malicious host can reduce the deadline arbitrarily to lock out participants from refunding their deposits. Since there is no data validation for the _days argument, the host can first set a proper deadline of 7 days. Then participants can deposit funds before the deadline passes. On the third day, for example, the host changes the deadline to days = 0, so now the fundraising ends, and participants will not be able to claim a refund if they decide to not be a part of the fundraising anymore.

POC

Add the following test suit in the ChristmasDinnerTest.t.sol.

function test_setInvalidDeadline() public {
vm.prank(deployer);
cd.setDeadline(0);
assertEq(block.timestamp, cd.deadline());
}

Impact

  1. Participants lose their deposits without recourse.

  2. Participants lose their trust in the protocol.

Tools Used

  • Manual review

  • Foundry

Recommendations

Modify the setDeadline function to allow updates only if the new deadline is greater than the existing deadline and add an appropriate error.

+ error DeadlineCannotBeReduced();
function setDeadline(uint256 _days) external onlyHost {
if (deadlineSet) {
revert DeadlineAlreadySet();
} else {
+ uint256 newDeadline = block.timestamp + _days * 1 days;
​
+ if (newDeadline <= deadline) {
+ revert DeadlineCannotBeReduced();
+ }
​
+ deadline = newDeadline;
emit DeadlineSet(deadline);
}
}
Updates

Lead Judging Commences

0xtimefliez Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

deadline is never set to true

0xtimefliez Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

deadline is never set to true

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.