Party DAO - Neon2835's results

Lines of code

https://github.com/code-423n4/2023-10-party/blob/b23c65d62a20921c709582b0b76b387f2bb9ebb5/contracts/crowdfund/ETHCrowdfundBase.sol#L148-L150 https://github.com/code-423n4/2023-10-party/blob/b23c65d62a20921c709582b0b76b387f2bb9ebb5/contracts/crowdfund/ETHCrowdfundBase.sol#L256-L258

Vulnerability details

Impact

In the _initialize function of the ETHCrowdfundBase contract, when minTotalContributions is equal to maxTotalContributions, crowdfund will never reach its minimum goal in some specific scenarios. The ETH of users who contribute to this crowdfund will be locked in the contract. They can only call the refund function to retrieve their ETH after the expiration time.

Proof of Concept

Suppose there is a new Party. During initialization, set the value of minTotalContributions equal to maxTotalContributions. The specific parameters are assumed to be:

Mintotalcontributions=10 eth Maxtotalcontributions=10 eth Mincontribution=2 eth Maxcontribution=3 eth Expiry=30 days

Now consider the following scenarios as examples:

1. three users have contributed 3 eth, so the current totalContributions=9 eth.
2. at this time, suppose Alice tries to contribute eth. Because maxTotalContributions=10 eth, he can contribute at most 1 eth, but minContribution=2 eth, so Alice can never complete the contribution. In this code segment, revert will always occur!

if (amount < minContribution_) {
    revert BelowMinimumContributionsError(amount, minContribution_);
}

Cod link: https://github.com/code-423n4/2023-10-party/blob/b23c65d62a20921c709582b0b76b387f2bb9ebb5/contracts/crowdfund/ETHCrowdfundBase.sol#L256-L258

This crowdfund will never reach 10eth means that the 9eth of the first three users will be locked in the contract for 30 days. Even the host cannot manually call finalize to end this crowdfund.

Tools Used

Visual Studio Code Foundry

Recommended Mitigation Steps

Optimize the code in line 148 of the _initialize function of the ETHCrowdfundBase contract, and use >= to replace >, as follows:

if (opts.minTotalContributions >= opts.maxTotalContributions) {
    revert MinGreaterThanMaxError(opts.minTotalContributions, opts.maxTotalContributions);
}

Assessed type

Other