Submission Details
Severity:
The `LikeRegistry` contract explicitely accepts to receive ETH but offers no way to withdraw it, blocking any ETH sent by mistake inside the contract.
**Description:** The `LikeRegistry::receive` function lets anyone send ETH to the contract. However, there is no way to get the ETH back, like via a `withdraw` function. This means any ETH sent to the contract, by mistake or not, cannot be recovered.
**Impact:** Funds will be lost forever if directly sent to the contract.
**Proof of Concept:**
Add the following code at the end of `testSoulboundProfileNFT.t.sol` :
```javascript
function testCanDepositButNotWithdraw() public {
LikeRegistry likeRegistry;
// random user that wants to spend money
address randomUser = makeAddr("randomUser");
// create like registry
likeRegistry = new LikeRegistry(address(soulboundNFT));
uint256 startingContractBalance = address(likeRegistry).balance;
// send ETH to the contract
uint256 moneySent = 1 ether;
vm.deal(randomUser, moneySent);
uint256 startingUserBalance = address(randomUser).balance;
vm.prank(randomUser);
(bool success, ) = address(likeRegistry).call{value: 1 ether}("");
if (success) {
console.log("ETH sent!");
}
// assert contract balance has increased
uint256 endingContractBalance = address(likeRegistry).balance;
assertEq(endingContractBalance, startingContractBalance + moneySent);
// assert user balance has decreased
uint256 endingUserBalance = address(randomUser).balance;
assertEq(endingUserBalance, startingUserBalance - moneySent);
}
```
**Recommended Mitigation:**
- Remove the `LikeRegistry::receive` function as it only handles ETH sent another way than via a function.
```diff
contract LikeRegistry is Ownable {
...
- /// @notice Allows the contract to receive ETH
- receive() external payable {}
}
```
Updates
Appeal created
n0kto 5 months ago
Submission Judgement Published Reason: Design choice
Assigned finding tags:
invalid_no_withdrawing_function_and_like_all_used
Money collected will be sent to the MultisigWallet during the first match. Emergency withdraw could lead to a frontrun before a match. "If the like is mutual, all their previous like payments (minus a 10% fee) are pooled into a shared multisig wallet" Design choice
invalid_receive_function
Not the best design, but if you send money accidentally, that's a user mistake. Informational.
Rewards breakdown
nSLOC
197This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.