Beginner FriendlySolidity
100 EXP
View results
Submission Details
Severity: high
Valid

Missing ETH Receive/Fallback Function Allowing Funds to Become Stuck

Summary

The contract does not implement a receive or fallback function, meaning that any ETH sent directly to the contract address will remain trapped. This oversight may lead to unintentional fund loss or restrict future contract interactions with accidental ETH transfers.

Vulnerability Details

In Solidity, if a contract lacks both a receive() and a fallback() function, it cannot handle plain ETH transfers. In this contract, there are functions for sending ETH out (e.g., sendETH), but no function to accept ETH is defined. As a result, any ETH sent directly (via plain transfers or accidental deposits) is locked in the contract, with no mechanism to retrieve or redirect it.

Impact

  • Loss of Funds: Users who accidentally send ETH to the contract risk permanently locking their funds.

  • User Frustration: The inability to recover mistakenly sent ETH may erode user trust and hamper adoption.

  • Operational Issues: Accumulated trapped ETH might affect overall contract balance management and could interfere with planned contract functionalities.

Tools Used

  • Manual Code Review

Recommendations

  1. Implement a receive() Function:
    Add a simple receive() function to accept ETH transfers:

    receive() external payable {
    // Optional: emit an event for transparency
    emit Received(msg.sender, msg.value);
    }
  2. Implement a Fallback Function (if needed):
    If the contract should handle unexpected data, include a fallback function to manage both data and ETH transfers:

    fallback() external payable {
    // Optional: revert or handle the call
    revert("Invalid call");
    }
  3. Emit Events for Incoming ETH:
    Log incoming transfers for monitoring and auditing purposes.

  4. Add Documentation and Testing:
    Clearly document the expected behavior for receiving ETH and create tests to ensure that ETH transfers are handled as intended.

Updates

Lead Judging Commences

0xtimefliez Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Missing receive() or fallback() function

0xtimefliez Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Missing receive() or fallback() function

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.