Submission Details
Severity:
No function to withdraw dealers' winnings
Summary
It is not possible to withdraw ETH (that comes form dealer's winnings) from the contract
Vulnerability Details
When the dealer wins, the ETH provided by players remains in the contract. There is no function to withdraw this winnings from the contract
Impact
This inability to withdraw ETH from the contract may result in loose ETH being stuck in the contract forever.
Tools Used
Manual review
Recommendations
Add an admin role and function that only an admin can call to take eth out of the contract. See the example below:
contract TwentyOne {
address payable admin;
constructor() {
admin = payable(msg.sender);
}
function withdraw(uint256 _amount) external {
require(msg.sender == admin, "Only Admin");
require(address(this).balance >= _amount);
(bool success,) = admin.call{value: _amount}("");
require(success, "Transfer failed");
}
// ----------------- REST OF THE CONTRACT ---------------------
}
Updates
Lead Judging Commences
inallhonesty 7 months ago
Submission Judgement Published Assigned finding tags:
Owner has no method to withdraw
Rewards breakdown
nSLOC
147This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.