ETH Balance Could Get Trapped In The Contract
Summary
Any eth balance left in the contract after deadline will be unrecoverable.
Vulnerability Details
Since users are able to pay using eth via the recieve() function, it means there is the possibility that the contract will have a positive eth balance. However, the withdraw() function does not transfer the eth balance of the contract to the host along with the ERC20s.
Impact
Once deadline has passed a user will not be able to collect a refund on any desposited eth. Accordingly, since withdraw() does not transfer the eth balance of the contract to the host, this means that the funds are lost in contract and will be unrecoverable.
Tools Used
Manual review.
Recommendations
Update withdraw()such that contract's eth balance is also tranfered to the host.
Lead Judging Commences
withdraw function lacks functionality to send ether
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.