Hawk High

First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Submission Details
Impact: high
Likelihood: medium
Invalid

Contract locks Ether without a withdraw function!

Summary

It appears that the contract `LevelOne` includes a payable function to accept Ether but lacks a corresponding function to withdraw it, which leads to the Ether being locked in the contract.

Vulnerability Details

Impact

1-Locked funds -> lose the rest of `schoolFees` permanently.
2-Contracts interacting with it may fail if they expect refunds.
3-If the contract was meant to be upgradeable but wasn’t, the funds are just stuck.

Tools Used

FOUNDRY

Recommendations

Add a withdraw or recovery function to the contract `LevelOne`, for example:
```diff
+ function withdraw(address payable _to) public onlyOwner {
+ _to.transfer(address(this).balance);
+ }
```

Updates

Lead Judging Commences

yeahchibyke Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Known issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!