Submission Details
Severity:
Lake of zero amount check in `InheritanceManager::sendETH` function.
Description
According to provided netspec the `InheritanceManager::sendETH` function can be use to move Eth or transfer Eth to someone. But there is lake of `zero` amount check in this function, Due to this owner can execute this function with `zero` amount of Eth successfully.
```javascript
function sendETH(uint256 _amount, address _to) external nonReentrant onlyOwner {
@> (bool success,) = _to.call{value: _amount}("");
require(success, "Transfer Failed");
_setDeadline();
}
```
Impact
User can execute the transction without sending any Eth.
Proof of Concept
Add this test function into `InheritanceManagerTest.t.sol` file.
Proof Of Code:
```javascript
function testNotEnoughEth() public {
address user2 = makeAddr("user2");
vm.prank(owner);
im.sendETH(0,user2);
}
```
```diff
[PASS] testNotEnoughEth() (gas: 39449)
Traces:
[39449] InheritanceManagerTest::testNotEnoughEth()
├─ [0] VM::addr(<pk>) [staticcall]
│ └─ ← [Return] user2: [0x537C8f3d3E18dF5517a58B3fB9D9143697996802]
├─ [0] VM::label(user2: [0x537C8f3d3E18dF5517a58B3fB9D9143697996802], "user2")
│ └─ ← [Return]
├─ [0] VM::prank(owner: [0x7c8999dC9a822c1f0Df42023113EDB4FDd543266])
│ └─ ← [Return]
├─ [27778] InheritanceManager::sendETH(0, user2: [0x537C8f3d3E18dF5517a58B3fB9D9143697996802])
│ ├─ [0] user2::fallback()
│ │ └─ ← [Stop]
│ └─ ← [Stop]
└─ ← [Stop]
Suite result: ok. 1 passed; 0 failed; 0 skipped; finished in 4.15ms (362.74µs CPU time)
```
Recommended Mitigation
This function should have to implement zero amount check.
```diff
function sendETH(uint256 _amount, address _to) external nonReentrant onlyOwner {
+ require(_amount > 0, "Amount should be more then zero");
(bool success,) = _to.call{value: _amount}("");
require(success, "Transfer Failed");
_setDeadline();
}
```
Rewards breakdown
nSLOC
211This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.