Christmas Dinner
First Flight #31
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Host can change deadline that is already set

k3ysk1lls

Summary

The contract allows the dealine variable to be set as many times as the host wants.

Vulnerability Details & Impact

The documentation doesn't say how many times host can change the deadline variable, but since there is a deadlineSet variable, I assume there should be a limit on changes to the deadline variable. The assumption is correct, because the dinner time is set by the host and everyone saves time for a specific date. But the contract allows you to set the dealine variable as many times as the host wants. It is not possible to set the deadlineSet variable to true.

Tools Used

Manual review and see function testChangeDeadline() in the foundry test below:

//SPDX-License-Identifier: MIT
​
pragma solidity 0.8.27;
​
import {Test, console2} from "forge-std/Test.sol";
import {ChristmasDinner} from "../src/ChristmasDinner.sol";
import {ERC20Mock} from "../lib/openzeppelin-contracts/contracts/mocks/token/ERC20Mock.sol";
​
contract XmasDinnerTest is Test {
ChristmasDinner cd;
ERC20Mock wbtc;
ERC20Mock weth;
ERC20Mock usdc;
​
uint256 constant DEADLINE = 7;
address deployer = makeAddr("deployer");
​
function setUp() public {
​
wbtc = new ERC20Mock();
weth = new ERC20Mock();
usdc = new ERC20Mock();
​
vm.startPrank(deployer);
cd = new ChristmasDinner(address(wbtc), address(weth), address(usdc));
vm.warp(1);
cd.setDeadline(DEADLINE);
vm.stopPrank();
}
​
function testChangeDeadline() public {
//deadline set in the setup
uint256 expectedDeadline = block.timestamp + DEADLINE * 1 days;
​
assert(cd.deadline() == expectedDeadline);
​
//can change deadline that is already set
vm.prank(deployer);
cd.setDeadline(10);
expectedDeadline = block.timestamp + 10 days;
assert(cd.deadline() == expectedDeadline);
}
}
​

Recommendations

Set ChristmasDinner::deadlineSet variable to true when setting dealine for the first time:

function setDeadline(uint256 _days) external onlyHost {
if (deadlineSet) {
revert DeadlineAlreadySet();
} else {
+ deadlineSet = true;
deadline = block.timestamp + _days * 1 days;
emit DeadlineSet(deadline);
}
}
Updates

Lead Judging Commences

0xtimefliez Lead Judge 11 months ago
Submission Judgement Published
Validated
Assigned finding tags:

deadline is never set to true

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.