Skip to content

Important: max_participants not enforced in register_team #21

@0xdevcollins

Description

@0xdevcollins

Severity: Important

The max_participants field on Hackathon is set at creation but never checked when registering teams. The cap is decorative.

Location

register_team in contracts/hackathon_registry/src/contract.rs (around line 238)

Fix

Before incrementing submission_count:

if hackathon.max_participants > 0 && hackathon.submission_count >= hackathon.max_participants {
    return Err(HackathonError::MaxParticipantsReached);
}

(MaxParticipantsReached already exists in error.rs:13.)

Tests

  • Registration at cap → MaxParticipantsReached
  • Registration below cap → ok
  • max_participants == 0 means unlimited (current behavior)

Metadata

Metadata

Assignees

No one assigned

    Labels

    audit-findingSurfaced during internal audit / reviewbugSomething isn't working

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions