Dria
Swan
NFTHardhat
21,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Functions send eth away from contract but performs no checks on any address.

mustaphaabdulaziz00

Summary

https://github.com/Cyfrin/2024-10-swan-dria/blob/c8686b199daadcef3161980022e12b66a5304f8e/contracts/core/WETH9.sol#L40

Consider introducing checks for `msg.sender` to ensure the recipient of the money is as intended.

Vulnerability Details

function could be vulnerable to reentrancy attacks, where an external contract could call withdraw recursively before the balanceOf[msg.sender] -= wad; line completes, allowing the attacker to withdraw more than intended. and If the balance of msg.sender is less than wad, the subtraction balanceOf[msg.sender] -= wad; could underflow, setting the balance to a very high number (if using Solidity <0.8.0). and the version is pragma solidity >=0.4.22 <0.6;

function withdraw(uint256 wad) public {
require(balanceOf[msg.sender] >= wad);
balanceOf[msg.sender] -= wad;
msg.sender.transfer(wad);
emit Withdrawal(msg.sender, wad);
}

Impact

Requiring msg.sender to match the recipient makes it explicit who can withdraw funds, ensuring that funds will only be transferred to the address initiating the request. This is beneficial for multi-user contracts or financial applications where maintaining a clear transfer trail is important.

Tools Used

manual

Recommendations

function withdraw(uint256 wad) public {
require(balanceOf[msg.sender] >= wad, "Insufficient balance");
​
// Update balance first (checks-effects-interactions pattern)
balanceOf[msg.sender] -= wad;
​
// Transfer funds to the user
(bool success, ) = msg.sender.call{value: wad}("");
require(success, "Transfer failed");
​
emit Withdrawal(msg.sender, wad);
}
​

The balance is updated before the transfer call, preventing reentrancy.

msg.sender.call{value: wad}("") is used, which is flexible with gas allocation but controlled to avoid unexpected behavior.

Updates

Lead Judging Commences

inallhonesty Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Out of scope

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.