You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
If the owner cancels the event, anyone can drain the contract via the withdraw function, even if they were not a participant. onlyPayable will allow anyone to withdraw if the event is cancelled, since notPaid will return participant.paid as false by default for a participant who never registered.
This means that when the event is cancelled any address who did not register can withdraw and receive the payoutAmount until there are no funds left.
N.B. have not tested this
The text was updated successfully, but these errors were encountered:
You don't want to risk sending it to 0x00 address (participant.addr will be 0x00) if they never registered. You might need to add a bool registered to Participants and set it to true on register?
Or you can do a check that participant.addr == msg.sender (which is set during registerInternal)
If the owner cancels the event, anyone can drain the contract via the withdraw function, even if they were not a participant. onlyPayable will allow anyone to withdraw if the event is cancelled, since notPaid will return participant.paid as false by default for a participant who never registered.
This means that when the event is cancelled any address who did not register can withdraw and receive the payoutAmount until there are no funds left.
N.B. have not tested this
The text was updated successfully, but these errors were encountered: