Beatland Festival
First Flight #44
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: low
Invalid

Contradictory information on which user withdraws fees.

mustby

Contradictory information on which user withdraws fees.

Description: It is crucial to be 100% clear and consistent on the responsibilities of all "roles" in a protocol. In the natsepc of FestivalPass::withdraw:

// Organizer withdraws ETH
function withdraw(address target) external onlyOwner {
payable(target).transfer(address(this).balance);
}

It claims that the "organizer" withdraws ETH but the function itself allows "onlyOwner" to withdraw ETH.

This contradiction is ALSO seen in the IFestivalPass.sol interface where the event "FundsWithdrawn" specifies "organizer" as the withdrawer.

/**
* @notice Emitted when the organizer withdraws collected funds
* @param organizer Address of the organizer
* @param amount Amount of ETH withdrawn
*/
event FundsWithdrawn(address indexed organizer, uint256 amount);

Impact: The could create confusion amongst the protocol and it is very important to be clear on which user is allowed to withdraw fees.


Proof of Concept:

Where the owner is said to be ETH withdrawer:

  1. FestivalPass::withdraw function logic itself

  2. IFestivalPass::withdraw function AND natspec

Where the organizer is said to be ETH withdrawer:

  1. FestivalPass::withdraw function natspec

  2. IFestivalPass.sol event FundsWithdrawn


Recommended Mitigation: Either change the natspec to be correct, or adjust the function itself to be "onlyOrganizer." However, I would simply correct the natspec as the "README.md" states, "Owner: The owner...collects the festival proceeds."

+ // Owner withdraws ETH
- // Organizer withdraws ETH
function withdraw(address target) external onlyOwner {
payable(target).transfer(address(this).balance);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 26 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.