DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

ETH Transfer Without Address Validation - Mishandling of Eth

glitchunter

Summary LikeRegistry.sol::withdrawFees Mishandling of Eth

Owner May Be a Smart Contract That Cannot Receive ETH.

Vulnerability Details

If owner() is set to a smart contract without a payable fallback function, the transfer will always fail. and could cause DOS.

Impact

The owner will never be able to withdraw funds, permanently locking ETH in the contract.

Tools Used

Manual Review / Aderyn

Recommendations

Allow specifying a recipient address instead of forcing owner()

event FeesWithdrawn(address indexed recipient, uint256 amount);
​
function withdrawFees(address recipient) external onlyOwner {
require(recipient != address(0), "Invalid recipient");
uint256 amount = address(this).balance;
payable(recipient).transfer(amount);
emit FeesWithdrawn(recipient, amount);
}
​
​
Updates

Appeal created

n0kto Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Admin is trusted

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelyhood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.