Christmas Dinner
First Flight #31
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

changeParticipationStatus() needs a participant check

riceee

Summary

The changeParticipationStatus()function doesn't check if the msg.sender is a registered participant of the protocol

Vulnerability Details

Any random user can call the changeParticipationStatus()function, irrespective of them being a participant. This error allows a random user to be updated as the participant of the protocol if they call this function before the deadline. Now since the participant[msg.sender] = truefor the non-participating user, resulting in a wrong state and on calling the deposit() function for the first time by them they emit the wrong event GenerousAdditionalContributionas well as they get acess to the refund()function given that refund has a participant check in place, resulting in wrong emits Refunded

Impact

Improper use of event emissions can mislead users or off-chain systems, such as dApps or explorers. Emitting false or extra events for actions that didn't occur can deceive systems and trigger unintended behavior

Tools Used

Manual Review

Recommendations

To ensure an account is a participant it has to have previously deposited tokens/ether into the contract and then changed their participation status. So we add that check initially to filter proper users who should be allowed to access this function.

function changeParticipationStatus() external {
//!!!Need to only allow prior particpiants to change their status
require(_hasBalanceInContract(msg.sender), "Only participants can change their status");//added
if(participant[msg.sender]) {
participant[msg.sender] = false;
} else if(!participant[msg.sender] && block.timestamp <= deadline) {
participant[msg.sender] = true;
} else {
revert BeyondDeadline();
}
emit ChangedParticipation(msg.sender, participant[msg.sender]);
}

and a _hasBalanceInContract is defined to check if the user has funds deposited in the contract:

function _hasBalanceInContract(address _user) private view returns (bool) {
uint256 totalBalance = balances[_user][address(i_USDC)] +
balances[_user][address(i_WBTC)] + balances[_user][address(i_WETH)] + etherBalance[_user];
​
if(totalBalance > 0) {
return true;
}
return false;
}
Updates

Lead Judging Commences

0xtimefliez Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

usage of change participation logic circumvents deposit

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!