Project

Summary

OWPIdentity.sol and MembershipFactory.sol inherit NativeMetaTransaction.sol . NativeMetaTransaction.executeMetaTransaction() is a payable function. When it is called it executes an external call:

address(this).call{value: msg.value}(abi.encodePacked(functionSignature, userAddress));

This sends ETH to either the OWPIdentity.sol or MembershipFactory.sol contract. However, neither can withdraw ETH. Any ETH sent via the function is permanently stuck in the contracts.

You cannot use the arbitrary callExternalContract() function to try to get the ETH out, because that first requires the caller to send more ETH, just to end up forwarding it to another contract.

Vulnerability Details

See Summary.

Impact

See Summary.

Tools Used

Manual Review

Recommendations

Remove the payable option for this function if it is not needed. If it is needed, allow the contracts that receive ETH to be able to withdraw the ETH.