Christmas Dinner
First Flight #31
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Missing ETH Withdrawal Mechanism

anis

Summary

The contract allows for the deposit of ETH but does not provide a method for the host to withdraw the ETH.

Vulnerability Details

The contract accepts ETH deposits but lacks a withdrawal function for ETH. This means that any ETH sent to the contract cannot be retrieved, which can lead to funds being trapped within the contract indefinitely. This is a design flaw as it contradicts typical contract expectations, where a method to withdraw ETH should exist if ETH is being accepted.

Impact

  • Funds are trapped: ETH deposited into the contract cannot be withdrawn.

  • Inconsistent behavior: If the contract allows ERC-20 token withdrawals, but not ETH withdrawals, it creates an inconsistent experience for the host and users.

Tools Used

Manual inspection of the contract.

Recommendations

Add a function that allows the host to withdraw ETH from the contract, for example:

function withdrawETH() external onlyHost {
payable(host).transfer(address(this).balance);
}
Updates

Lead Judging Commences

0xtimefliez Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

withdraw function lacks functionality to send ether

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!