Beatland Festival
First Flight #44
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: low
Invalid

No Fallback or Receive Function — ETH Transfers Revert Without Clear Reason

r4y4n3

Root + Impact

Description

  • Normal Behavior:
    A contract should handle unexpected ETH transfers gracefully, either by accepting them (so they can be withdrawn) or by reverting with a clear error message to prevent accidental loss or confusion.

    Issue:
    The FestivalPass contract does not implement a receive() or fallback() function. If someone sends ETH directly to the contract (not via buyPass), the transaction reverts with no clear reason. This can confuse users and integrators, and is not best practice.

// No receive() or fallback() function is defined in FestivalPass.sol

Risk

Likelihood:

  • This will occur if a user or contract mistakenly sends ETH directly to the contract address, which is a common mistake in the Ethereum ecosystem.

Impact:

  • The transaction will revert, potentially confusing users and causing failed transactions. There is no clear error message or handling for such cases, which can lead to poor user experience and support issues. In some cases, users may believe their ETH was accepted when it was not.

Proof of Concept

The following test demonstrates that sending ETH directly to the contract reverts, with no clear reason provided:

function testDirectETHTransferIsAcceptedAndLocked() public {
vm.startPrank(user);
(bool sent, ) = address(festival).call{value: 1 ether}("");
assertTrue(sent, "ETH transfer failed"); // This will fail, as the transfer reverts
vm.stopPrank();
}

Recommended Mitigation

Add a receive() function to the contract to explicitly handle direct ETH transfers.
You can either revert with a clear message, or accept ETH if that is desired. Or, to allow ETH deposits:

OPTION1:
​
+ // Add this to FestivalPass.sol
+ receive() external payable {
+ revert("Direct ETH transfers not allowed");
+ }
​
OPTION2:
+ receive() external payable {}
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.