Christmas Dinner
First Flight #31
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

M1 - Unauthorized Participation Without Deposit

xmrsaifx

Summary:\

The changeParticipationStatus function allows anyone to become a participant without making a deposit. This creates a logical vulnerability that permits unauthorized users to attend the event without fulfilling payment requirements.

Vulnerability Details:\

The changeParticipationStatus function does not validate whether a deposit has been made before updating the participant's status. As a result, anyone can invoke this function and set their participation status to true, bypassing the intended payment requirement.

Affected Code:

function changeParticipationStatus() external {
if(participant[msg.sender]) {
participant[msg.sender] = false;
} else if(!participant[msg.sender] && block.timestamp <= deadline) {
participant[msg.sender] = true;
} else {
revert BeyondDeadline();
}
emit ChangedParticipation(msg.sender, participant[msg.sender]);
}
​

Impact:\

The event host may need to accommodate a significantly higher number of attendees than expected.
Resources for the event could be strained due to the presence of unauthorized participants.
Genuine participants who have paid may experience a diluted event experience due to overcapacity.

Steps to Reproduce:\

Deploy the smart contract containing the changeParticipationStatus function.
Call the changeParticipationStatus function from any address without making a deposit.
Observe that the address is added as a participant despite not fulfilling any payment requirement.

Tools Used:\

Manual Review
Foundry Framework

Recommendation:\

Introduce a mapping to track payment status for each address and verify this status before updating participation status.

Updates

Lead Judging Commences

0xtimefliez Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

usage of change participation logic circumvents deposit

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.