Christmas Dinner
First Flight #31
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Missing deadline check in receive() allows post-deadline participation

0xgo4ko

Summary

The receive() function, which handles Ether deposits, does not enforce a deadline check. As a result, users can send ETH (even zero-value transactions which is a known issue) and become participants after the deadline. While users cannot claim refunds after the deadline, this behavior undermines the protocol's intended time-bound participation rules and may result in confusion or mistrust among participants, especially when they are unable to refund their deposits.

Vulnerability Details

The receive() function enables users to deposit Ether and automatically become participants in the event. However, there is no validation to ensure that deposits occur only within the allowed deadline period. The contract’s current design assumes social conventions to manage participation, but allowing deposits after the deadline contradicts the intent of limiting participation to a specific timeframe. This could erode trust and confuse users, especially when they are unable to refund their deposits.

POC

Add the following test to the ChristmasDinnerTest contract:

function test_userCanDepositAfterDeadline() public {
vm.deal(user1, 2 ether);
vm.startPrank(user1);
(bool success1, ) = address(cd).call{value: 1 ether}("");
require(success1, "transfer failed");
​
// post-deadline
vm.warp(DEADLINE * 1 days + 1 days);
(bool success2, ) = address(cd).call{value: 1 ether}("");
require(success2, "transfer failed");
vm.stopPrank();
​
assertEq(address(cd).balance, 2 ether);
}

Impact

  1. Users may mistakenly believe they are legitimate participants after the deadline, only to discover they cannot refund their deposits.

  2. Zero-value deposits post-deadline enable users to gain participant status without contributing.

  3. The contract's logic to enforce a clear deadline for participation is flawed.

Tools Used

  • Manual review

Recommendations

Add a deadline check to the receive() function to enforce the participation cutoff. Reject deposits if the deadline has passed, ensuring users cannot become participants post-deadline.

receive() external payable {
if (block.timestamp > deadline) {
revert BeyondDeadline();
}
// more function code
}
Updates

Lead Judging Commences

0xtimefliez Lead Judge 11 months ago
Submission Judgement Published
Validated
Assigned finding tags:

receive() function independant from deadline

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.