Submission Details
Severity:
Contracts are designed to receive ETH but do not implement function for
Summary
Contracts are designed to receive ETH but do not implement function for
Vulnerability Details
The following contracts can receive ETH but can not withdraw, ETH is occasionally sent by users will be stuck in those contracts. This functionality also applies to baseTokens resulting in locked tokens and loss of funds.
Impact
File: src/Proxy.sol
51: fallback() external {
52: address implementation = _implementation;
53: assembly {
54: let ptr := mload(0x40)
55: calldatacopy(ptr, 0, calldatasize())
56: let result := delegatecall(gas(), implementation, ptr, calldatasize(), 0, 0)
57: let size := returndatasize()
58: returndatacopy(ptr, 0, size)
59:
60: switch result
61: case 0 { revert(ptr, size) }
62: default { return(ptr, size) }
63: }
64: }
Tools Used
Personal bot
Recommendations
Provide a rescue ETH and rescueTokens function
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
19477 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.