Beatland Festival
First Flight #44
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: medium
Invalid

No Validation of Target Address in Withdraw Function

r4y4n3

Root + Impact

Description

  • Normal Behavior:
    The withdraw(address target) function should safely transfer the contract’s ETH balance to a valid recipient address. It is expected that the function prevents accidental loss of funds by ensuring the recipient is not the zero address.

    Issue:
    The function does not check if the target address is the zero address. If the owner mistakenly calls withdraw(address(0)), all ETH in the contract will be sent to the zero address and permanently lost. This is a common mistake that can occur due to a misconfigured script, UI bug, or human error.

function withdraw(address target) external onlyOwner {
payable(target).transfer(address(this).balance);
}

Risk

Likelihood:

  • This can occur if the owner makes a mistake, a script passes an uninitialized address, or a UI bug submits a zero address.

Impact:

  • All ETH in the contract can be lost forever if sent to the zero address. This is irreversible and can result in significant financial loss.

Proof of Concept

Suppose the contract has a balance of 10 ETH. If the owner accidentally calls address(0), All 10 ETH will be sent to the zero address, and are unrecoverable. This can be simulated in a test by calling the function with address(0) and checking that the contract balance drops to zero, but the ETH is not received by any valid account.

// This call will send all contract ETH to the zero address, resulting in permanent loss.
festival.withdraw(address(0));

Recommended Mitigation

Add a check to ensure the target address is not zero. This prevents accidental loss of funds and aligns with best practices for secure contract development.

- function withdraw(address target) external onlyOwner {
- payable(target).transfer(address(this).balance);
- }
+ function withdraw(address target) external onlyOwner {
+ require(target != address(0), "Cannot withdraw to zero address");
+ payable(target).transfer(address(this).balance);
+ }
Updates

Lead Judging Commences

inallhonesty Lead Judge 27 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Zero address check

Owner/admin is trusted / Zero address check - Informational

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.