DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Insufficient Balance Check Missing in submitTransaction (Potential Execution Failure)

pablitoamaral

Description

The MultiSigWallet.submitTransaction function allows owners to create transactions that will later be executed upon approval. However, it does not check if the contract has enough ETH to execute the transaction.

This means that users can submit and approve transactions with a high _value, only for them to fail later during execution due to insufficient contract balance. Since executeTransaction does not revalidate the contract’s balance before attempting to send ETH, this issue leads to wasted user approvals and gas fees.

Additionally, the contract has no built-in way to remove failed transactions, potentially clogging the system with unexecutable entries.

Impact

  • Execution failure: Transactions that exceed the contract's balance will be recorded, approved, and then fail upon execution, wasting gas and approvals.

  • User confusion: Owners may approve transactions that look valid but will ultimately fail, reducing trust in the system.

Tools Used

manual

Proof of concept

There is no checking here

function submitTransaction(
address _to,
uint256 _value
) external onlyOwners {
if (_to == address(0)) revert InvalidRecipient();
if (_value == 0) revert InvalidAmount();
​
transactions.push(Transaction(_to, _value, false, false, false));
uint256 txId = transactions.length - 1;
emit TransactionCreated(txId, _to, _value);
}

Recommendations

function submitTransaction(
address _to,
uint256 _value
) external onlyOwners {
if (_to == address(0)) revert InvalidRecipient();
if (_value == 0) revert InvalidAmount();
+ require(address(this).balance >= _value, "Insufficient contract balance");
​
transactions.push(Transaction(_to, _value, false, false, false));
uint256 txId = transactions.length - 1;
emit TransactionCreated(txId, _to, _value);
}
Updates

Appeal created

n0kto Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Users mistake, only impacting themselves.

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.