Submission Details
Severity:
Funds stuck in RAACNFT contract.
Summary
There is no method implemented in the RAACNFT contract to return the user's tokens.
Vulnerability Details
RAACNFT contract allow users to mint nfts by supplying token, an issue with this is that there's no implementation or method to get back these sent tokens, meaning the tokens will be in the contract forever.
Impact
Users funds is lock in RAACNFT contract.
Tools Used
Manual Review
Recommendations
Implement only owner method to get back the user token amounts.
function withdrawFunds() external onlyOwner {
uint256 balance = token.balanceOf(address(this));
require(balance > 0, "No funds to withdraw");
token.safeTransfer(owner(), balance);
}
Updates
Lead Judging Commences
inallhonesty 7 months ago
Submission Judgement Published Assigned finding tags:
RAACNFT collects payment for NFT minting but lacks withdrawal functionality, permanently locking all tokens in the contract
inallhonesty 7 months ago
Submission Judgement Published Assigned finding tags:
RAACNFT collects payment for NFT minting but lacks withdrawal functionality, permanently locking all tokens in the contract
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420
USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.