Christmas Dinner
First Flight #31
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Lack of Validation for Zero Deposit Amount in deposit Function

koinerdegen

Summary

The deposit function lacks validation for a deposit amount of zero, allowing users to participate in the event and emit the NewSignup event without actually transferring any funds. This bypasses the intended logic of requiring a monetary commitment to participate in the event.

Vulnerability Details

Code Location

function deposit(address _token, uint256 _amount) external beforeDeadline {
if (!whitelisted[_token]) {
revert NotSupportedToken();
}
if (participant[msg.sender]) {
balances[msg.sender][_token] += _amount;
IERC20(_token).safeTransferFrom(msg.sender, address(this), _amount);
emit GenerousAdditionalContribution(msg.sender, _amount);
} else {
participant[msg.sender] = true;
balances[msg.sender][_token] += _amount;
IERC20(_token).safeTransferFrom(msg.sender, address(this), _amount);
emit NewSignup(
msg.sender,
_amount,
getParticipationStatus(msg.sender)
);
}
}

Description

The function does not check whether the _amount is greater than zero before allowing a user to participate. This means a user can:

  1. Call the deposit function with _amount = 0.

  2. Bypass the monetary commitment expected for participation.

  3. Trigger the NewSignup event, registering as a participant without transferring any funds.

This vulnerability undermines the integrity of the participation logic and could lead to abuse, as users can become participants for free.

Comparison with changeParticipationStatus

The changeParticipationStatus function properly toggles participation status but does not allow users to make financial commitments. By exploiting the deposit function with _amount = 0, a user can achieve similar results with the added benefit of misleadingly registering as a paying participant.

Impact

This vulnerability allows malicious or careless users to:

  1. Register as event participants without transferring any funds.

  2. Trigger misleading events (NewSignup) without any financial commitment.

  3. Potentially disrupt event organizers who rely on deposit amounts to gauge event funding or capacity.

Tools Used

  • Manual code review

  • Static analysis

Recommendations

  1. Add Validation for Non-Zero Amounts: Ensure _amount > 0 in the deposit function before proceeding.

    if (_amount == 0) {
    revert ZeroDepositNotAllowed();
    }

  2. Emit Separate Event for Zero Contributions: If zero contributions are intentionally allowed, emit a different event to distinguish them from actual deposits.

    if (_amount == 0) {
    emit ZeroContributionAttempt(msg.sender);
    return;
    }

  3. Strengthen Event Logic: Refactor the deposit function to ensure that only valid deposits trigger NewSignup or GenerousAdditionalContribution events.

  4. Test Cases: Include test cases for zero deposit scenarios to ensure proper validation and behavior.

By implementing these measures, the contract can ensure that participation and event signup logic remains robust and secure.

Updates

Lead Judging Commences

0xtimefliez Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.