Beginner FriendlyFoundryNFT
100 EXP
View results
Submission Details
Severity: medium
Valid

withdrawFees require balance = totalFees

Summary

withdrawFees require balance = totalFees, is it possible this might never be true?

Vulnerability Details

it's possible the contract balance might not be equal to totalFees if no players are active. this would result in fees never being able to be withdrawn

Impact

possible that fees could never be withdrawn

Tools Used

VSCode

Recommendations

use a function to return the number of active players (ie. player's array length) instead of comparing balance to fees
and revert if # of players != 0 instead. Then when there are no active players, it will return 0 and will allow withdrawing of fees

Updates

Lead Judging Commences

Hamiltonite Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

greifers-send-money-to-contract-to-block-withdrawfees

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!