Weather Witness
First Flight #40
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Missing withdrawal function leads to stuck contract funds

red_jamie

Root + Impact

Description

  • There is no function in the contract that allows the owner (or anyone) to withdraw the accumulated AVAXfrom the contract balance.

    This means:

    • Any AVAX sent via requestMintWeatherNFT is currently stuck in the contract.

    • This could eventually lock up significant funds.

Risk

Likelihood:

  • No existing withdrawal logic; AVAX and LINK are actively collected during requestMintWeatherNFT.

Impact:

  • Funds become permanently inaccessible.

Recommended Mitigation

  • Add a withdrawal function like for example:

function withdraw(address payable recipient) external onlyOwner {
require(recipient != address(0), "Invalid address");
recipient.transfer(address(this).balance);
}
Updates

Appeal created

bube Lead Judge 5 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Lack of `withdraw` function

The contract collects funds for minting a WeatherNFT, but there is no function that allows the owner to withdraw these funds.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.