Submission Details
Severity:
External Calls Inside a Loop - DOS
The recoverTokens function has external calls inside a loop, which can lead to denial-of-service attacks.
function recoverTokens(address[] calldata _tokens, address _receiver) external onlyOwner {
if (_receiver == address(0)) revert InvalidReceiver();
for (uint256 i = 0; i < _tokens.length; ++i) {
IERC20 tokenToTransfer = IERC20(_tokens[i]);
tokenToTransfer.safeTransfer(_receiver, tokenToTransfer.balanceOf(address(this)));
}
}
Implement a pull mechanism where users withdraw their tokens themselves instead of the contract pushing tokens to them. This can be done by recording the amounts owed to each user and allowing them to withdraw their tokens.
Prize pool breakdown
Total prize
27,500 USDC
nSLOC
1,41419 USDC / LOC
25,000 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.