DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing Balance Check in executeTransaction before execution

0xblackadam

Description:

The MultiSigWallet contract lacks a balance check in the `executeTransaction` function before attempting to transfer ETH. This means the contract will attempt the transfer even when it has insufficient balance, leading to:

  • Unnecessary gas consumption as the transaction will fail at the low-level call stage;

  • Poor user experience as failures happen at the execution stage rather than being caught early

Lines of code

(https://github.com/CodeHawks-Contests/2025-02-datingdapp/blob/878bd34ef6607afe01f280cd5aedf3184fc4ca7b/src/MultiSig.sol#L68)

Impact:

  • Users waste gas on transactions that are guaranteed to fail;

Recommendations

  • Add a balance check before attempting the transfer:

function executeTransaction(uint256 _txId) external onlyOwners {
require(_txId < transactions.length, "Invalid transaction ID");
Transaction storage txn = transactions[_txId];
require(!txn.executed, "Transaction already executed");
require(txn.approvedByOwner1 && txn.approvedByOwner2, "Not enough approvals");
// Add this check
require(address(this).balance >= txn.value, "Insufficient contract balance");
​
txn.executed = true;
(bool success,) = payable(txn.to).call{value: txn.value}("");
require(success, "Transaction failed");
​
emit TransactionExecuted(_txId, txn.to, txn.value);
}

This change ensures that transactions will fail early with a clear error message if there's insufficient balance and saving gas.

Tools Used

Manual Review + Foundry Testing Framework

Updates

Appeal created

n0kto Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Users mistake, only impacting themselves.

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.