Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG]: Wardens Able to Submit Reports for Role-Specific Audits #12333

Open
kaveyjoe opened this issue Aug 25, 2023 · 2 comments
Open

[BUG]: Wardens Able to Submit Reports for Role-Specific Audits #12333

kaveyjoe opened this issue Aug 25, 2023 · 2 comments
Labels
bug Something isn't working

Comments

@kaveyjoe
Copy link

## Description
There is an issue with the audit submission process on Code4rena. Audits are intended to be limited to specific participants, specifically to certified/backstage role members. However, any warden, regardless of their role association, can submit a report for these audits.

Impact

This has the potential to compromise the integrity of audits by allowing unauthorized wardens to submit reports for audits they are not eligible for.

To Reproduce

1 . Log in to the Code4rena platform.
2 . Navigate to the audit page that is intended only for certified/backstage role members.
3 . Instead of being restricted, any warden user can access the submission form directly by appending "/submit" to the audit link (e.g., https://code4rena.com/audits/audit-name/submit).
4 . The report submission form opens without any validation to check if the user is eligible for this audit.

Expected behavior

Only limited specific participants should be able to access the report submission form for audits limited to specific participants . Any attempt by other wardens or users without the proper role should be denied access to the submission form.

Actual Behaviour

Currently, any warden can access the report submission form for audits intended only members. The system allows them to submit reports without any validation or checks for eligibility.

@kaveyjoe kaveyjoe added the bug Something isn't working label Aug 25, 2023
@kaveyjoe kaveyjoe changed the title [BUG]: [BUG]: Wardens Able to Submit Reports for Role-Specific Audits Aug 25, 2023
@kaveyjoe
Copy link
Author

kaveyjoe commented Aug 25, 2023

@Simon-Busch @natevw

@natevw
Copy link
Contributor

natevw commented Aug 29, 2023

Hi @kaveyjoe, thanks for the report! I pinged the C4 builder team about this again today and wanted to confirm that they are looking into it. Appreciate the detailed writeup.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants