Christmas Dinner
First Flight #31
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Lack of Support for Signing Up Other Users in deposit() Function (same for receive() function)

anis

Summary

The deposit() function does not allow users to sign up other users, which may limit flexibility for event organizers who want to enroll multiple participants on behalf of others.

Vulnerability Details

The deposit() function only allows the sender to deposit for themselves and sign up as a participant. There's no functionality to enable a user to sign up other users, which could be useful in a scenario where one user wishes to sponsor or register multiple participants.

Impact

The protocol doesn't support the ability for one user to sign up others, potentially causing inconvenience and limiting use cases for the contract in social events where organizers or sponsors wish to enroll others.

Tools Used

Manual code review

Recommendations

Modify the deposit() function to allow users to specify an address for another participant. Implement a parameter to specify the user being signed up and adjust logic accordingly. Here's the corrected code:

function deposit(address _token, uint256 _amount, address _participant) external beforeDeadline {
if (!whitelisted[_token]) {
revert NotSupportedToken();
}
address user = (_participant == address(0)) ? msg.sender : _participant; // Allow signing up others
if (participant[user]) {
balances[user][_token] += _amount;
IERC20(_token).safeTransferFrom(msg.sender, address(this), _amount);
emit GenerousAdditionalContribution(user, _amount);
} else {
participant[user] = true;
balances[user][_token] += _amount;
IERC20(_token).safeTransferFrom(msg.sender, address(this), _amount);
emit NewSignup(user, _amount, getParticipationStatus(user));
}
}
Updates

Lead Judging Commences

0xtimefliez Lead Judge 11 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Deposit function lacks functionality

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.