ArkProject: NFT Bridge

Summary

The withdrawTokens function in the smart contract is marked as payable, allowing the function to receive Ether.
However, the function does not handle or account for the received Ether, leading to the risk of Ether being permanently
locked within the contract.

Vulnerability Details

In the withdrawTokens function, the payable keyword allows the function to receive Ether when called.
However, the function logic does not include any mechanism to process, refund, or utilize the msg.value.
As a result, any Ether sent to this function will be stuck in the contract, as there is no way to retrieve or manage it.

Since msg.value is ignored within the function, any Ether sent to the contract will remain locked, with no way to return it to the sender.

Impact

The primary impact of this vulnerability is the loss of Ether. Users may inadvertently send Ether to the withdrawTokens function,
which will then become unrecoverable, leading to financial loss. This issue can also affect the contract's reputation and user trust,
as the inability to recover stuck Ether may be perceived as a critical flaw.

Recommendations

To prevent Ether from being stuck in the contract, the following actions are recommended:

Remove payable from the Function Signature: