Submission Details
Severity:
No Withdrawal Function: Ethers Permanently Locked in TwentyOne Contract
Summary
TwentyOne contract can collect ethers, but lacks a withdraw function, causing all collected ethers to be permanently locked in the contract.
Vulnerability Details
TwentyOne::StartGame()is payable allowing players to send ethers. However, there is no withdrawal method for the deployer or admin to retrieve ethers from the contract, resulting in permanent fund lockup.
Impact
Ethers will remain locked in the contract, inaccessible to any party.
Tools Used
Manual Review
Recommendations
Include a withdrawal function or owner-controlled transfer function, such as:
address owner;
constructor() {
owner = msg.sender;
}
function withdraw(uint amount, address payable to) external {
require(msg.sender == owner, "Only Owner can withdraw");
require(amount <= address(this).balance, "Insufficient balance");
(bool success, ) = to.call{value : amount}("");
require(success, "Fail to withdraw");
}
Updates
Lead Judging Commences
inallhonesty 6 months ago
Submission Judgement Published Assigned finding tags:
Owner has no method to withdraw
Rewards breakdown
nSLOC
147This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.