Potential Loss of User Funds Due to Unrestricted withdrawFees Function in Pending Transactions
Summary:
The user loses money, when in pending state, if the withdrawFees function is called.
Vulnerability Details:
If a user initiates a “trick” purchase (double-cost) but pays only part of the cost, their ETH is held in the contract until they call resolveTrick. During this period, the funds are "pending" and intended for completing the NFT purchase. However, because withdrawFees does not account for these pending funds, the contract owner could accidentally withdraw them, potentially preventing the user from finishing their transaction.
Impact:
Potential loss of funds for the user.
Tools Used:
Manual review
Recommendations:
Adjust withdrawFees Logic: Ensure that withdrawFees only withdraws the contract’s free balance, excluding pending funds.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.