Received ETH cannot be withdrawn from contract
Summary
All ETH that is sent to the RockPaperScissors contract via RockPaperScissors::receive() can never be withdrawn.
Vulnerability Details
It is intended that the RockPaperScissors contract is able to accept ETH via receive() however the admin is only able to withdraw from the pot of accumulated fees.
The admin cannot withdraw ETH accepted via RockPaperScissors::receive() because its amount was not added to the accumulated fees.
Impact
Funds that are sent to the RockPaperScissors contract via RockPaperScissors::receive() will be locked in the contract and are effectively lost forever.
Tools Used
Manual Review.
Recommendations
Simply add the received amount to accumulatedFees in order to allow the admin to withdraw received ETH:
Appeal created
Orphaned ETH due to Unrestricted receive() or Canceled Game
ETH sent directly to the contract via the receive function or after a canceled game becomes permanently locked
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.