Submission Details
Severity:
GMXWithdraw.processWithdraw potentially sending Ether to an arbitrary address
Summary
Unprotected call to a function sending Ether to an arbitrary address.
Vulnerability Details
(success) = self.withdrawCache.user.call{value: address(this).balance}() can be dangerous and send ether to an arbitrary address
Impact
Anyone can send ether to an arbitrary address
Tools Used
Slither, Manual Code Review
##Recommendation
Ensure that an arbitrary user cannot withdraw unauthorized funds.
Prize pool breakdown
Total prize
35,000 USDC
nSLOC
2,28915 USDC / LOC
33,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.