Submission Details
Severity:
Missing Admin Access Control on Fee Withdrawal
Missing Administrative Access Control on Fee Withdrawals
Summary
The withdrawal of accumulated platform fees is not protected by an access control modifier, allowing anyone to withdraw funds.
Vulnerability Details:
Critical functions managing platform funds should require administrative access.
Code Snippet:
function withdrawFees() external {
uint256 amount = platformFees;
platformFees = 0;
payable(msg.sender).transfer(amount);
}
Impact:
Any user could steal accumulated platform funds, causing financial losses and damaging trust.
Tools Used:
Solidity
VS Code
Recommendations:
Add an onlyAdmin modifier:
modifier onlyAdmin() {
require(msg.sender == admin, "Not authorized");
_;
}
and use it:
function withdrawFees() external onlyAdmin {
...
}
Rewards breakdown
nSLOC
349This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.