Trapped ETH in `LikeRegistry.sol` due to unhandled `receive` function
Description:
The `LikeRegistry` contract implements a receive function that allows it to accept ETH transfers, but lacks any mechanism to track or handle these incoming funds:
Additionally, there's no functionality to extract or process ETH received through this function. While the contract has withdrawFees, it only handles the protocol fees tracked by totalFees variable, leaving any ETH received through receive permanently locked in the contract.
Impact:
ETH sent directly to the contract becomes permanently trapped
No way to account for or recover these funds
Potential loss of user funds if they accidentally send ETH directly to the contract
Recommended Mitigation:
Remove or restrict the receive() function if direct ETH transfers are not needed or implement proper tracking and handling
Appeal created
invalid_receive_function
Not the best design, but if you send money accidentally, that's a user mistake. Informational.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.