Submission Details
Severity:
Using `transfer` in `withdrawFees()`
Summary
The withdrawFees() function uses transfer to withdraw funds from the contract to the owner's address.
Vulnerability Details
In line 146 of the SpookySwap contract where the withdrawFees() function was defined, was transfer used as the method to send ether to the owner from the contract
Impact
The function is at risk of reentrancy attack as the transfer method is not the best way to send ether
Tools Used
Recommendations
The call method should be used instead of transfer.
(bool success, ) = payable(owner).call{value: balance}("");
require(success, "Withdrawal failed");
Updates
Appeal created
bube about 1 year ago
Submission Judgement Published Assigned finding tags:
Use of `transfer` instead of `call`
Rewards breakdown
nSLOC
109This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.