Submission Details
Severity:
withdrawFees should have onlyOwner modifier
Summary
OnlyOwner should be allowed to call the withdrawFees function to enhance security and control.
Vulnerability Details
It allows anyone to call this function, whenever they want.
Impact
If the owner is intending to change the feeAddress (maybe they no longer have access to that account) and hasn't yet done so a malicious actor can call this function and there will be a loss of funds.
Tools Used
Manual Review
Recommendations
add the openZeppelin onlyOwner modifier
function withdrawFees() external onlyOwner {
require(address(this).balance == uint256(totalFees), "PuppyRaffle: There are currently players active!");
uint256 feesToWithdraw = totalFees;
totalFees = 0;
(bool success,) = feeAddress.call{value: feesToWithdraw}("");
require(success, "PuppyRaffle: Failed to withdraw fees");
}
Updates
Lead Judging Commences
Hamiltonite about 2 years ago
Submission Judgement Published Reason: User experience and design improvement
Rewards breakdown
nSLOC
143This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.