Weather Witness
First Flight #40
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

M-1: Missing Admin Ether Withdrawal Function — Ether Locked in Contract

qasimlab118

Missing Admin Ether Withdrawal Function — Ether Locked in Contract

Description

The WeatherNft contract contains the requestMintWeatherNFT function, marked payable, allows users to send Ether when minting a Dynamic Weather NFT. The minting fee (s_currentMintPrice) increases with each call, meaning the contract can accumulate a significant Ether balance over time.

However, the contract lacks a function that allows the owner or admin to withdraw the collected Ether. As a result, all Ether sent to the contract remains permanently locked unless a withdrawal mechanism is implemented. This limits the contract's usability and control for its owner.

Risk

Ether locked in a contract—inability for the contract owner to retrieve accumulated Ether.

Likelihood:

  • No attacker can exploit this directly — the loss is to the contract owner/admin due to inaccessible funds.

  • If the contract becomes popular, more Ether gets locked, increasing the financial risk.

Impact:

  • Ether locked in a contract

  • Inability for contract owner to retrieve accumulated Ether.

Recommended Mitigation

IF we add a withdrawal function for the admin, so the admin can call and withdraw the contract balance, then this issue will be solved
Add This function on WeatherNft contract:

function withdrawEther() external onlyOwner {
uint256 balance = address(this).balance;
require(balance > 0, "No Ether to withdraw");
(bool success, ) = payable(owner()).call{value: balance}("");
require(success, "Ether withdrawal failed");
}
​
Updates

Appeal created

bube Lead Judge 6 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Lack of `withdraw` function

The contract collects funds for minting a WeatherNFT, but there is no function that allows the owner to withdraw these funds.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.