Submission Details
Severity:
The withdraw() function does not withdraw ETH, which results in the Host not receiving the ETH.
Summary
The withdraw() function does not implement the sending of ETH to the Host.
function withdraw() external onlyHost {
address _host = getHost();
i_WETH.safeTransfer(_host, i_WETH.balanceOf(address(this)));
i_WBTC.safeTransfer(_host, i_WBTC.balanceOf(address(this)));
i_USDC.safeTransfer(_host, i_USDC.balanceOf(address(this)));
}
Impact
This results in the Host not receiving ETH, which is a critical issue as the Host will miss out on ETH income.
Tools Used
Manual review
Recommendations
Add functionality in the withdraw() function to send ETH to the Host, ensuring that the Host collects all the tokens.
function withdraw() external onlyHost {
address _host = getHost();
i_WETH.safeTransfer(_host, i_WETH.balanceOf(address(this)));
i_WBTC.safeTransfer(_host, i_WBTC.balanceOf(address(this)));
i_USDC.safeTransfer(_host, i_USDC.balanceOf(address(this)));
_host.transfer(etherBalance[address(this)]);
}
Updates
Lead Judging Commences
0xtimefliez 7 months ago
Submission Judgement Published Assigned finding tags:
withdraw function lacks functionality to send ether
0xtimefliez 7 months ago
Submission Judgement Published Assigned finding tags:
withdraw function lacks functionality to send ether
Rewards breakdown
nSLOC
129This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.