Stuck Ether in the Contract Due to Lack of Withdraw Function
Summary
The buyOrder function allows users to send Ether to the contract for purchasing tokens. However, in scenarios where there is an overpayment (due to user error or miscalculations in the function), the excess Ether sent to the contract remains stuck, as there is no mechanism for withdrawing the trapped funds.
Vulnerability Details
Impact
Any Ether accidentally overpaid by the buyer is permanently stuck in the contract.
Ether left in the contract as a result of a calculation error in buyerOrder is stuck in the contract
Tools Used
Manual Review
Recommendations
Add a withdrawEther function to allow the contract owner to recover stuck Ether in the contract.
Lead Judging Commences
Token misshandling
The extra eth sent by the user in the buy order will be locked in the contract forever
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.