`receive()` function does not authorize requests
Summary
Having no access control on the function (e.g. require(msg.sender == address(weth))) means that someone may send Ether to the contract, and have no way to get anything back out, which is a loss of funds. If there is concern about having to spend a small amount of gas to check the sender against an immutable address, the code should at least have a function to rescue mistakenly sent Ether.
Vulnerability Details
There is 1 instance of this issue.
| File Link | Instance Count | Instance Link |
|---|---|---|
| BridgeReth.sol | 1 | 37 |
Impact
Funds may be lost if sent to the contract inadvertently.
Tools Used
baudit: a custom static code analysis tool; manual review
Recommendations
Add access control to the receive() function to control who can send Ether to the contract.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.