Submission Details
Severity:
When users send ETH directly to the `LikeRegistry` contract there is no way to withdraw funds resulting in ETH being locked in contract
Summary
If users send ETH directly to the LikeRegistrycontract without calling a function funds will be lost because there is no way to withdraw the ETH.
Impact
Loss of funds because the withdrawFeesfunction on withdraws totalFees.
Tools Used
Manual code review
Recommendations
Update the totalFeesvariable in the receivefunction so its possible for the owner to withdraw the funds:
receive() external payable {
+ totalFees += msg.value
}
Updates
Appeal created
n0kto 4 months ago
Submission Judgement Published Reason: Non-acceptable severity
Assigned finding tags:
invalid_receive_function
Not the best design, but if you send money accidentally, that's a user mistake. Informational.
Rewards breakdown
nSLOC
197This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.