Summary

Discovered a vulnerability in the emergencyPause and emergencyResume functions of a smart contract, where unchecked msg.value can lead to unintended Ether retention.

Vulnerability Details

The functions set the executionFee directly equal to msg.value, without validating whether the sent Ether exceeds the required fee. Excess Ether sent is not refunded and is wrongly treated as the fee.

Code Snippets:

Impact

This flaw could result in financial losses for users sending more Ether than the execution fee requires, as there's no system to refund the surplus. Such incidents could undermine user trust and contract credibility.

Tools Used

Manual code review and analysis.

Recommendations

Urgently revise these functions to include:

• Validation checks against msg.value to ascertain it doesn't exceed the necessary executionFee.

• Automatic refunds for any excess Ether received, ensuring only the intended fee amount is retained.