Submission Details
Severity:
Anyone can front-run the `unwrapAndSendETH` steal the funds by just withdrawing
Summary
attacker Can create a denial of service for the EOA that deployed the contract
Vulnerability Details
attacker Can create a denial of service for the EOA that deployed the contract
Impact
Anyone call the unwrapAndSendETH and steal all the funds to their address account
Tools Used
manual
Recommendations
1.remove the function
or
2. add a function modifier
or
3. Add a mapping that tracks how much a user sent to the contract and let that user deposited value be
used when a user wants to make a withdraw
or
4.The address that sends funds should be the only one that can make a withdrawal: using this code
function unwrapAndSendETH(address to) external {
+ require(msg.sender==WETH, "not owner");
uint256 wethBalance = IWETH(WETH).balanceOf(address(this));
require(wethBalance > 0, "Insufficient WETH");
IWETH(WETH).withdraw(wethBalance);
(bool success, ) = to.call{value: address(this).balance}(
new bytes(0)
);
require(success, "Eth transfer Failed.");
}
Updates
Lead Judging Commences
giovannidisiena about 1 year ago
Submission Judgement Published Reason: Design choice
Assigned finding tags:
Pipeline access control
Prize pool breakdown
Total prize
100,000 USDC
nSLOC
5,77617 USDC / LOC
95,000 USDC
5,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.