Christmas Dinner
First Flight #31
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

H1 - Attendee can mislead the host by performing multiple signups with small deposits.

xmrsaifx

Summary

The current implementation allows an attendee to repeatedly deposit small amounts (e.g., $1), change their participation status, and deposit again. This results in inflated participant counts, misleading the host about the actual number of unique participants.

Vulnerability Details

The deposit function does not restrict users from signing up multiple times with separate deposits. Combined with the changeParticipationStatus function, attendees can toggle their participation status and deposit again, leading to inaccurate participant tracking and potential misuse of event resources.

Affected Code :

function deposit(address _token, uint256 _amount) external beforeDeadline {
if(!whitelisted[_token]) {
revert NotSupportedToken();
}
if(participant[msg.sender]){
balances[msg.sender][_token] += _amount;
IERC20(_token).safeTransferFrom(msg.sender, address(this), _amount);
emit GenerousAdditionalContribution(msg.sender, _amount);
} else {
participant[msg.sender] = true;
balances[msg.sender][_token] += _amount;
IERC20(_token).safeTransferFrom(msg.sender, address(this), _amount);
emit NewSignup(msg.sender, _amount, getParticipationStatus(msg.sender));
}
}
​
function changeParticipationStatus() external {
if(participant[msg.sender]) {
participant[msg.sender] = false;
} else if(!participant[msg.sender] && block.timestamp <= deadline) {
participant[msg.sender] = true;
} else {
revert BeyondDeadline();
}
emit ChangedParticipation(msg.sender, participant[msg.sender]);
}

Impact

  • Inflated participant count creates logistical challenges for event planning.

  • Misuse of the system could reduce resources allocated for genuine participants.

  • May undermine the credibility of the event due to inaccurate data.

Steps to Reproduce

  1. Call the deposit function with a small amount and set participation status to true.

  2. Call changeParticipationStatus to toggle the status to false.

  3. Repeat the deposit and status change process to register multiple times as a participant.

Tools Used

  • Manual Review

  • Foundry Framework

Recommendations

Implement checks to prevent multiple signups from the same user and track each participant as a unique entity. Create a mapping for the hasSignup for the address to bool.

Updates

Lead Judging Commences

0xtimefliez Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.