Christmas Dinner
First Flight #31
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Ether remains locked in contract

yoanyjd

Summary

The current contract does not include functionality for the host to withdraw Ether, leaving Ether locked within the contract. The contract allows the withdrawal of ERC20 tokens but fails to handle the withdrawal of Ether, thus preventing the host from accessing any Ether balance stored in the contract.

Vulnerability Details

In the withdraw function, the contract allows the host to withdraw ERC20 tokens such as WETH, WBTC, and USDC, but it does not include a mechanism for the host to withdraw Ether (ETH) from the contract. As a result, any Ether deposited in the contract remains locked and inaccessible to the host.

function withdraw() external onlyHost {
address _host = getHost();
i_WETH.safeTransfer(_host, i_WETH.balanceOf(address(this)));
i_WBTC.safeTransfer(_host, i_WBTC.balanceOf(address(this)));
i_USDC.safeTransfer(_host, i_USDC.balanceOf(address(this)));
} // not handling the withdraw of the ETH

Impact

**Locked Ether: **Any Ether sent to the contract remains locked, as there is no functionality to allow the host to withdraw it.

Loss of Funds: If Ether is deposited into the contract, the host will be unable to retrieve it, which could lead to a loss of funds over time, especially if the contract accumulates a significant Ether balance

Tools Used

Manual code review

Recommendations

To resolve this issue, the contract should include functionality to allow the host to withdraw Ether. Here's a suggested modification:

function withdraw() external onlyHost {
address _host = getHost();
i_WETH.safeTransfer(_host, i_WETH.balanceOf(address(this)));
i_WBTC.safeTransfer(_host, i_WBTC.balanceOf(address(this)));
i_USDC.safeTransfer(_host, i_USDC.balanceOf(address(this)));
// Withdraw Ether using call to avoid gas limitation
uint256 ethBalance = address(this).balance;
(bool success, ) = _host.call{value: ethBalance}("");
require(success, "Ether withdrawal failed");
}
Updates

Lead Judging Commences

0xtimefliez Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

withdraw function lacks functionality to send ether

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!