Submission Details
Severity:
Native ETH can be stuck in the contract
Summary
The TradingAccountBranch::createTradingAccountAndMulticall() is responsible for creating a trading account and execute different function on it such as depositMargin()
Vulnerability Details
This function is payable meaning ETH can be sent during the transaction. This value is never used anywhere else in Zaros meaning the ETH will remain in the contract with no way to retrieve it.
Impact
Funds can be lost in the contract.
Tools Used
Manual review
Recommendations
Remove the payable from the function.
Updates
Lead Judging Commences
inallhonesty 10 months ago
Submission Judgement Published Assigned finding tags:
`createTradingAccountAndMulticall` shouldn't be payable
Prize pool breakdown
Total prize
60,000 USDC
nSLOC
2,87821 USDC / LOC
50,000 USDC
5,500 USDC
4,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.