TSender

Summary

The TSender_NoCheck contract currently lacks the functionality to reject Ether transfers. This omission potentially allows users to inadvertently send Ether to the contract, which may result in the loss of funds, as the contract does not have a mechanism to return or utilize these Ether.

Vulnerability Details

In its current state, the Huff version of the TSender_NoCheck contract does not contain checks or restrictions against receiving Ether. This could happen in two ways:

• Direct Ether transfers to the contract address.

• Executing functions with a non-zero msg.value.

• Without appropriate safeguards, these actions could lead to Ether being permanently locked within the contract, as there is no function to withdraw or refund the Ether.

Reference Implementation

https://www.codehawks.com/report/clr6s75ut00013qg9z8bpkalo#M-03

Impact

The potential impact of this vulnerability includes:

• Unintentional loss of funds for users who mistakenly send Ether to the contract.

• Negative user experience and possible reputational damage for the project.

• Increased scrutiny and potential security concerns from the community and stakeholders.

Tools Used

Manual review

Recommendations

If callvalue > 0, it should revert.