Rock Paper Scissors
First Flight #38
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Reentrancy Vulnerability in Fee Withdrawal

cybervenom

Summary

The withdrawFees function in RockPaperScissors.sol is vulnerable to reentrancy attacks because it performs an external call to transfer ETH before updating the accumulatedFees state variable.

Vulnerability Details

The withdrawFees function sends ETH to the admin address using a low-level call before subtracting the withdrawn amount from accumulatedFees. This allows a malicious admin contract to re-enter the function and withdraw more fees than available.

Vulnerable Code:

function withdrawFees(uint256 _amount) external {
require(msg.sender == adminAddress, "Only admin can withdraw fees");
​
uint256 amountToWithdraw = _amount == 0 ? accumulatedFees : _amount;
require(amountToWithdraw <= accumulatedFees, "Insufficient fee balance");
​
accumulatedFees -= amountToWithdraw;
​
(bool success,) = adminAddress.call{value: amountToWithdraw}("");
require(success, "Fee withdrawal failed");
​
emit FeeWithdrawn(adminAddress, amountToWithdraw);
}

The state update (accumulatedFees -= amountToWithdraw) occurs after the external call (adminAddress.call), violating the checks-effects-interactions pattern.

Impact

A malicious admin contract could repeatedly call withdrawFees within the same transaction, draining the contract's entire ETH balance before accumulatedFees is updated, leading to loss of funds.

Tools Used

  • Manual code review

  • Slither (static analysis tool)

Recommendations

  1. Follow the checks-effects-interactions pattern by updating the state before making external calls.

  2. Consider using OpenZeppelin's ReentrancyGuard to prevent reentrancy.

Recommended Fix:

Add ReentrancyGuard from OpenZeppelin and include the nonReentrant modifier.

Updates

Appeal created

m3dython Lead Judge 2 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
m3dython Lead Judge 2 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
cybervenom Submitter
2 months ago
m3dython Lead Judge
2 months ago
m3dython Lead Judge 2 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.