DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

ETH Sent to receive() is Permanently Locked (Loss of Funds)

pablitoamaral

Description

The contract LikeRegistry includes a receive() function that allows it to accept ETH. However, there is no mechanism to withdraw ETH sent this way, making any funds sent directly to the contract permanently inaccessible. Since receive() does not update userBalances or totalFees, this ETH is neither used for rewards nor available for withdrawal by the owner.

/// @notice Allows the contract to receive ETH
receive() external payable {}

Impact

  • Any ETH sent directly to the contract is lost forever.

  • The contract balance can increase indefinitely, but there is no way to recover ETH that was not explicitly counted as fees.

  • Users who mistakenly send ETH via receive() will never be able to withdraw it, and the owner cannot retrieve it either.

Proof of Concept

1- A user sends ETH directly to the contract:

(bool success, ) = address(likeRegistry).call{value: 1 ether}("");
require(success);

2- The contract accepts the ETH due to receive(), but the balance remains locked:

receive() external payable {} // No tracking, no withdrawal function
​

3- Since totalFees is not updated, the owner cannot withdraw this ETH via withdrawFees().

4- The ETH is permanently stuck in the contract.

Tools Used

Manual

Recommendations

1- Implement a function to allow the owner to withdraw trapped ETH:

function withdrawAll() external onlyOwner {
payable(owner()).transfer(address(this).balance);
}

2- Alternatively, track ETH received in userBalances to ensure usability:

receive() external payable {
userBalances[msg.sender] += msg.value;
}

3- Do not Accept

fallback() external payable {
revert("Direct ETH transfers not allowed");
}
Updates

Appeal created

n0kto Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

invalid_receive_function

Not the best design, but if you send money accidentally, that's a user mistake. Informational.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.