Fallback `receive()` Function with Receive Ether lacks logic. Malicious actors could exploit this to send arbitrary Ether to the contract, leading to unintended behavior or Ether drainage.
Summary
The receive() function without any logic can be a vulnerability point, potentially allowing anyone to send Ether to the contract without constraints.
Vulnerability Details
https://github.com/Cyfrin/2023-12-the-standard/blob/91132936cb09ef9bf82f38ab1106346e2ad60f91/contracts/LiquidationPoolManager.sol#L31C4-L31C34
Impact
An attacker could potentially use this function to drain Ether from the contract.
Tools Used
VsCode / Manual
Recommendations
Consider implementing specific logic or restrictions within the receive() function to handle incoming Ether appropriately. If the contract is not intended to accept Ether, it may be more secure to remove the receive() function altogether.
Or remove or hidden if not being used
Lead Judging Commences
informational/invalid
informational/invalid
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.