Submission Details
Severity:
No function to withdraw ETH for owner, results in ETH locked in contract
Summary
While users/funders can deposit ETH, there are no function to withdraw it for the owner, resulting in loss of funds.
Vulnerability Details
Users can deposit ether by calling the receive function :
receive() external payable {
etherBalance[msg.sender] += msg.value;
emit NewSignup(msg.sender, msg.value, true);
}
And can withdraw their funds from the function refund, which calls _refundETH :
function _refundETH(address payable _to) internal {
uint256 refundValue = etherBalance[_to];
_to.transfer(refundValue);
etherBalance[_to] = 0;
}
But there are no function for the owner to withdraw the eth when the deadline passes, resulting in loss of funds.
Impact
Loss of funds, as the owner cannot withdraw the ether.
Recommendations
Add a function to withdraw the ether, accessible only from the owner, and after the deadline.
Updates
Lead Judging Commences
0xtimefliez about 1 year ago
Submission Judgement Published Assigned finding tags:
withdraw function lacks functionality to send ether
Rewards breakdown
nSLOC
129This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.