60,000 USDC
Submission Details
Severity:
Withdraw function should not be payable
Details
withdrawTokens function in L1 bridge contract should not be payable. Withdrawing tokens from bridge doesn't require any ETH currently. User may accidentally send ether with this call. As there is no sweep function, ETH sent will be stuck in contract.
Recommendations
Remove payable for withdrawTokens
Updates
Lead Judging Commences
n0kto 11 months ago
Submission Judgement Published Reason: Non-acceptable severity
Assigned finding tags:
Informational / Gas
Please, do not suppose impacts, think about the real impact of the bug and check the CodeHawks documentation to confirm: https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity A PoC always helps to understand the real impact possible.
Prize pool breakdown
Total prize
60,000 USDC
nSLOC
2,30126 USDC / LOC
50,000 USDC
5,500 USDC
4,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.