Permanently Locked ETH in Contract
Root Cause: The contract lacks a mechanism to withdraw ETH sent by users (except via
withdrawFees, which only handles fees). SinceuserBalancesare not updated, all ETH remains stuck.Impact: Users cannot recover their ETH, leading to permanent fund loss.
Recommendation:
Add an emergency withdrawal function (guarded by multi-sig or timelock) to recover stuck ETH.
Fix the
userBalancestracking issue as above to prevent future locking.
Appeal created
invalid_no_withdrawing_function_and_like_all_used
Money collected will be sent to the MultisigWallet during the first match. Emergency withdraw could lead to a frontrun before a match. "If the like is mutual, all their previous like payments (minus a 10% fee) are pooled into a shared multisig wallet" Design choice
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.