Submission Details
Severity:
withdrawFees has no access control, anyone can withdraw the fees
Summary
The vulnerability of missing access control in the "withdrawFees" function allows unauthorized users to potentially withdraw fees, leading to the risk of fund loss and financial disruption for the contract.
Vulnerability Details
PuppyRaffle:withdrawFees function lacks access control, allowing anyone to withdraw the fees
Impact
Unauthorized individuals can withdraw the fees, potentially resulting in the loss of collected funds intended for the owner and disrupting the contract's financial operations.
Tools Used
Manual review & foundry
Recommendations
-function withdrawFees() external {
+function withdrawFees() external onlyOwner {
Make sure to add the modifier code:
modifier onlyOwner() {
require(msg.sender == owner, "Only the contract owner can call this function");
_;
}
Updates
Lead Judging Commences
Hamiltonite almost 2 years ago
Submission Judgement Published Reason: User experience and design improvement
Rewards breakdown
nSLOC
143This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.