Submission Details
Severity:
Fee may stuck in the contract when accepting an unexpected ether
Summary
Fee may stuck in the contract when accepting an unexpected ether.
Vulnerability Details
withdrawFees requires the contract balance to be equal to totalFees.
If someone sends an unexpected ether by self-destruct, the contract balance will equal the totalFees, leading to the funds stuck in the contract.
function withdrawFees() external {
require(address(this).balance == uint256(totalFees), "PuppyRaffle: There are currently players active!");
uint256 feesToWithdraw = totalFees;
totalFees = 0;
(bool success,) = feeAddress.call{value: feesToWithdraw}("");
require(success, "PuppyRaffle: Failed to withdraw fees");
}
Impact
The fund will stuck in the contract.
Tools Used
Manual review.
Recommendations
Add a state to recognize if the raffle is ended.
Updates
Lead Judging Commences
Hamiltonite about 2 years ago
Submission Judgement Published Assigned finding tags:
greifers-send-money-to-contract-to-block-withdrawfees
Rewards breakdown
nSLOC
143This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.