Submission Details
Severity:
withdrawFees function can be called by anyone
Summary
withdrawFees function should be called by owner and not by anyone , this may cause problems
Vulnerability Details
function withdrawFees() external {
//@audit If this got force sent ether, than you can never withdraw, balance will be != than totalFees
require(address(this).balance == uint256(totalFees), "PuppyRaffle: There are currently players active!");
uint256 feesToWithdraw = totalFees;
totalFees = 0;
(bool success,) = feeAddress.call{value: feesToWithdraw}("");
require(success, "PuppyRaffle: Failed to withdraw fees");
}
Impact
Low
Tools Used
Manual review
Recommendations
Implement onlyowner modifier.
Updates
Lead Judging Commences
Hamiltonite about 2 years ago
Submission Judgement Published Reason: User experience and design improvement
Rewards breakdown
nSLOC
143This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.