Submission Details
Severity:
Force feeding the contract will lead to a permanent DoS of the withdrawFees function
Summary
Force feeding ether into the contract will break a require statement inside the withdrawFees function, which leads to a permanent DoS.
Vulnerability Details
The withdrawFees function looks like this:
function withdrawFees() external {
require(address(this).balance == uint256(totalFees), "PuppyRaffle: There are currently players active!");
uint256 feesToWithdraw = totalFees;
totalFees = 0;
(bool success,) = feeAddress.call{value: feesToWithdraw}("");
require(success, "PuppyRaffle: Failed to withdraw fees");
}
The first require statement will always lead to a DoS as soon as anyone force feeds ether into the contract.
Impact
Permanent DoS of the withdrawFees function, which will therefore lead to all the protocol fees being stuck in the contract forever.
Tools Used
Manual Review
Recommendations
Remove the require statement.
Updates
Lead Judging Commences
Hamiltonite about 2 years ago
Submission Judgement Published Assigned finding tags:
greifers-send-money-to-contract-to-block-withdrawfees
Rewards breakdown
nSLOC
143This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.