Skip to content

[BUG]: Wardens Able to Submit Reports for Role-Specific Audits #12333

Open
@kaveyjoe

Description

@kaveyjoe

## Description
There is an issue with the audit submission process on Code4rena. Audits are intended to be limited to specific participants, specifically to certified/backstage role members. However, any warden, regardless of their role association, can submit a report for these audits.

Impact

This has the potential to compromise the integrity of audits by allowing unauthorized wardens to submit reports for audits they are not eligible for.

To Reproduce

1 . Log in to the Code4rena platform.
2 . Navigate to the audit page that is intended only for certified/backstage role members.
3 . Instead of being restricted, any warden user can access the submission form directly by appending "/submit" to the audit link (e.g., https://code4rena.com/audits/audit-name/submit).
4 . The report submission form opens without any validation to check if the user is eligible for this audit.

Expected behavior

Only limited specific participants should be able to access the report submission form for audits limited to specific participants . Any attempt by other wardens or users without the proper role should be denied access to the submission form.

Actual Behaviour

Currently, any warden can access the report submission form for audits intended only members. The system allows them to submit reports without any validation or checks for eligibility.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions