Beanstalk Part 1
Beanstalk
DeFiHardhatOracleProxyUpdates
100,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

`unwrapAndSendETH` is missing validation of recipient, user fund can be lost

0xtheblackpanther

Summary

The issue arises from the possibility of users mistakenly entering the zero address (0x000...) as the recipient (to) address when calling the unwrapAndSendETH function in the UnwrapAndSendETH contract. This oversight can result in the loss of funds as the ETH transferred to the zero address cannot be recovered.

Impact

If a user mistakenly provides the zero address as the recipient when calling the unwrapAndSendETH function, the ETH transferred from the contract will be irreversibly lost. This can lead to financial losses for the user and may impact the usability and trustworthiness of the contract.

Recommendation

To mitigate this issue, the following steps can be taken:

Input Validation: Implement input validation to ensure that the to address provided is not the zero address and is a valid Ethereum address format.

E.g new code will look like this:

/// @notice Unwrap WETH and send ETH to the specified address
/// @dev Make sure to load WETH into this contract before calling this function
function unwrapAndSendETH(address to) external {
// Ensure the 'to' address is not zero
require(to != address(0), "Invalid 'to' address");
​
// Validate the 'to' address format
require(to != address(this), "Invalid 'to' address"); // Prevent sending to this contract itself
​
// Check WETH balance
uint256 wethBalance = IWETH(WETH).balanceOf(address(this));
require(wethBalance > 0, "Insufficient WETH");
​
// Withdraw WETH and transfer ETH to the specified address
IWETH(WETH).withdraw(wethBalance);
(bool success,) = to.call{value: address(this).balance}(new bytes(0));
require(success, "ETH transfer failed. Check 'to' address.");
}
Updates

Lead Judging Commences

giovannidisiena Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

Informational/Invalid

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.