Christmas Dinner
First Flight #31
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Host able to withdraw balances before deadline

parmakhanm786

Vulnerability Details

The withdraw function is restricted to the host of the contract through the onlyHost modifier. It transfers the entire balance of WETH, WBTC, and USDC tokens from the contract to the host's address. There is no check to ensure that the withdrawal is only allowed after a certain deadline. This means the host can withdraw funds at any time, even before the intended deadline, which could be against the intended use case of the contract.

Impact

the host can withdraw the balances before other participants have settled, potentially disrupting the system's intended flow.

Tools Used

Manual , vs code

Recommendations

​
function withdraw() external onlyHost {
address _host = getHost();
+ require(block.timestamp > deadline);
i_WETH.safeTransfer(_host, i_WETH.balanceOf(address(this)));
i_WBTC.safeTransfer(_host, i_WBTC.balanceOf(address(this)));
i_USDC.safeTransfer(_host, i_USDC.balanceOf(address(this)));
}
Updates

Lead Judging Commences

0xtimefliez Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

withdraw is callable before deadline ends

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.