Christmas Dinner
First Flight #31
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Eth balance is locked in the contract

al88nsk

Summary

There is no functions to withdraw eth balance from the contract for the host, thus all eth funds are locked in the contract after deadline.

Vulnerability Details

The function ChristmasDinner::withdraw is supposed to be used to withdraw all funds for the host. However, it only withdraws tokens from the contract and does not withdraw eth. Since there is only way to withdraw eth funds from the contract - refund by the participant before deadline, all eth funds are locked in the contract after the deadline.

Impact

The host can not withdraw eth funds from the contract.

Tools Used

Manual review

Recommendations

Withdraw eth funds in the withdraw function as below:

function withdraw() external onlyHost {
address _host = getHost();
i_WETH.safeTransfer(_host, i_WETH.balanceOf(address(this)));
i_WBTC.safeTransfer(_host, i_WBTC.balanceOf(address(this)));
i_USDC.safeTransfer(_host, i_USDC.balanceOf(address(this)));
+ _host.transfer(address(this).balance);
}
Updates

Lead Judging Commences

0xtimefliez Lead Judge 8 months ago
Submission Judgement Published
Validated
Assigned finding tags:

withdraw function lacks functionality to send ether

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.