Submission Details
Severity:
Missing function to withdraw ERC20 tokens
Summary and Vulnerability Details
The contract handles various ERC20 token, however, it lacks a function that allows to withdraw ERC20 token that may have been sent to the contract by accident or are stuck in the contract.
Impact
ERC20 tokens that are stuck in the contract or have been sent to the contract by accident cannot be withdrawn.
Tools Used
Manual Review
Recommendations
Add a withdrawal function to the AaveDIVAWrapper contract. Something like:
function withdrawERC20(address tokenAddress, uint256 amount) external onlyOwner {
require(tokenAddress != address(0), "Invalid token address");
require(amount > 0, "Amount must be greater than zero");
require(
IERC20(tokenAddress).balanceOf(address(this)) >= amount,
"Insufficient contract balance"
);
bool success = IERC20(tokenAddress).transfer(owner, amount);
require(success, "Token transfer failed");
}
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
51929
USDC / LOC
14,000
1,000
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.