Unrestricted Withdrawal of Platform Fees
Summary
The withdrawPlatformFees function allows the owner to withdraw the total balance of platform fees, which could potentially allow them to drain all funds before validators and generators are compensated. This could undermine the fairness of the fee distribution among participants, leading to unintended fund distribution and potential trust issues in the platform.
Vulnerability Details
The withdrawPlatformFees function enables the owner to transfer the entire feeToken balance from the contract to their address without any restriction. This could result in a scenario where the owner withdraws all funds, leaving no tokens available to pay validators and generators.
Impact
validators and generators not receiving their due fees
Tools Used
Manual code review
Recommendations
Modify the withdrawPlatformFees function to only allow the withdrawal of surplus funds after validators and generators have received their fees
Lead Judging Commences
`withdrawPlatformFees` withdraws the entire balance
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.