Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Missing Post-Upgrade Withdrawal Function Leaves Remaining Funds Locked

phylax

Summary

After the distribution of wages and upgrading to LevelTwoimplementation there is no withdraw function for owner of protocol to call leaving the remaining fees (65%) locked in contract.

Impact

With no possibility to withdraw the remaining fees the funds are locked in protocol.

Tools Used

Manual code review

Recommendations

In LevelTwocontract add a withdrawFeesfunction and give access control, either to the principal, or a owner which is set when initializing LevelOne contract.

In the below example I show how to implement the code in LevelTwocontract with onlyPrincipal modifier:

error HH__NotPrincipal()
​
modifier onlyPrincipal() {
if (msg.sender != principal) {
revert HH__NotPrincipal();
}
_;
}
​
function withdrawFees() external onlyPrincipal {
uint256 balance = usdc.balanceOf(address(this));
require(balance > 0, "No fees to withdraw");
usdc.safeTransfer(principal, balance);
bursary = 0;
}
​
Updates

Lead Judging Commences

yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

stuck funds in system

Funds are stuck in `LevelOne()` contract after upgrade.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.