Rigor Protocol contest - aez121's results

Lines of code

https://github.com/code-423n4/2022-08-rigor/blob/b17b2a11d04289f9e927c71703b42771dd7b86a4/contracts/Community.sol#L206

Vulnerability details

Impact

The team had mentioned in order to publish a project, the project must at least have one task which means a budget > 0. However, the function publish project does not check that; a member can post a project without any task.

THis is where they mentioned that:

Builder publishes his project to the community. It requires signing data that
includes community ID, APR, publishing fee and nonce . Both builder and community owner have to sign the data. The signatures and data are used to call publishProject(bytes _data, bytes _signature) .
Note that you cannot submit a project with no total budget. Therefore it requires at least one task with a budget > 0.

Proof of Concept

The function for publishProject
https://github.com/code-423n4/2022-08-rigor/blob/b17b2a11d04289f9e927c71703b42771dd7b86a4/contracts/Community.sol#L206 It must check if the project has a task before publishing the project else it must revert else a user can create a project and directly added to the community which is against what the team described