withdrawFees
function have incorrect implementation of condition, that will lock the fees permanently.
Consider following code snippet, problematic line is highlighted.
Consider the following scenario, selectWinner is called, now winner is paid and new round started. Now owner try to withdraw fees. But his transaction is front run by user by calling enterRaffle
. Since now fund in contract is greator than fees, so it will revert. It will happens most of the time and fee will stuck there forever.
Collected ETH fees will be locked in the contract.
Manual Review
update the require like this, as fees is accounted seperately so owner should be able to claim it whenever he want.
Here is the updated function
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.