Submission Details
Severity:
Potential reentrancy attack
Summary
the call option of withdrawing ether is the most flexible option but it s quite risky because of its susceptibiliy to reentrant attack
Vulnerability Details
function withdrawFunds() public {
require(msg.sender == owner, "Only owner can withdraw");
- (bool success,) = payable(owner).call{value: address(this).balance}("");
+ (bool success,) = payable(owner).Transfer{value: address(this).balance}("");
require(success, "Transfer failed");
}
Impact
it is medium because even though it is susceptible to reentrant attack, it won't expose the user to external attack since the contract had been set to make sure only the owner can withdraw from it
Tools Used
Manual review
Recommendations
function withdrawFunds() public {
require(msg.sender == owner, "Only owner can withdraw");
- (bool success,) = payable(owner).call{value: address(thi).balance}("");
+ (bool success,) = payable(owner).Transfer{value: address(this).balance}("");
require(success, "Transfer failed");
}
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.