In case if user contributes with 0 amount, his delegate is not changed

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-10-party/blob/main/contracts/crowdfund/InitialETHCrowdfund.sol#L297-L298

Vulnerability details

Proof of Concept

Using InitialETHCrowdfund._contribute, user can provide some funds together with delegate and receive some voting power instead and delegate it(together with all other user's voting power) to provided delegate.

It's possible that user will provide 0 amount. As comment states it can be used to change user's delegator. The problem is that this will change delegator only inside ETHCrowdfundBase, which is actually useless for the Party and then function will return. And real delegator in the Party will not be changed in this case.

As result, user will think that he had changed delegator, but in reality it will be same.

Impact

Delegator for user will not be changed.

Tools Used

VsCode

Recommended Mitigation Steps

In case if amount is 0, then change delegator for user.

if (amount == 0) {
    delegateVotingPower(delegate);
    return;
}

But be careful with using this by third parties. This should not be allowed or somehow restricted.

Assessed type

Error

[ydspa]

delegate here before return
https://github.com/code-423n4/2023-10-party/blob/b23c65d62a20921c709582b0b76b387f2bb9ebb5/contracts/crowdfund/InitialETHCrowdfund.sol#L295C23-L295C43

invalid

[c4-pre-sort]

ydspa marked the issue as insufficient quality report

[c4-judge]

gzeon-c4 marked the issue as unsatisfactory:
Invalid

[rvierdiiev]

hello @gzeon-c4
would you consider this report as as duplicate of #311, however partially?
i acknowledge that i have missed whole problem and impact, however i find part of it

from primary issue

If voting power is 0, _contribute returns and new delegate is NOT propagated to party contract (InitialETHCrowdfund.sol#L298).

this is exactly what describes this report.

i would be happy to get partial 50 or even less if you think so.
thank you

[c4-judge]

gzeon-c4 marked the issue as duplicate of #311

[c4-judge]

gzeon-c4 marked the issue as partial-25

[c4-judge]

gzeon-c4 marked the issue as duplicate of #418