Christmas Dinner
First Flight #31
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Missing Participant Status Reset in Refund Function

codehawky

Bug description

The refund() function contains a critical flaw where it refunds all tokens and ETH to the user but fails to reset their participant status in the participant mapping. This oversight allows users to maintain their participant status even after withdrawing all their funds.

This vulnerability can be exploited in several ways:

  1. Users can withdraw all their funds while maintaining participant privileges

  2. These "zero-stake" participants can still:

    • Be counted as valid participants for the event

    • Potentially become the host through the changeHost function

    • Change their participation status through changeParticipationStatus

  3. This could lead to inaccurate participant counting and potential manipulation of the event organization

PoC

contract ChristmasDinnerExploit {
function exploit(ChristmasDinner dinner, IERC20 usdc) external {
// 1. Initial deposit to become participant
usdc.approve(address(dinner), 1000e6);
dinner.deposit(address(usdc), 1000e6);
// 2. Get refund - gets all money back
dinner.refund();
// 3. Still maintains participant status
bool isStillParticipant = dinner.getParticipationStatus(address(this));
assert(isStillParticipant == true); // This will pass
// 4. Can still become host if current host assigns it
// dinner.changeHost(address(this)); // Would succeed if called by current host
}
}
​

Recommendation

Add participant status reset in the refund function:

function refund() external nonReentrant beforeDeadline {
address payable _to = payable(msg.sender);
_refundERC20(_to);
_refundETH(_to);
participant[msg.sender] = false; // Add this line
emit Refunded(msg.sender);
}
​
Updates

Lead Judging Commences

0xtimefliez Lead Judge 11 months ago
Submission Judgement Published
Validated
Assigned finding tags:

refund does not update participation status

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.