Submission Details
Impact:
Likelihood:
Incorrect Comment for FestivalPass::withdraw , which states that organizers withdraw ETH, this could lead to improper misuse of the withdraw function
Root + Impact
Description
The function Festival::withdraw contains a natspec which is misleading, it states organizers withdraw ETH/ Proceeds but in actual sense only the owner withdraws these Proceeds.
// Root cause in the codebase with @> marks to highlight the relevant section
Risk
Likelihood:
This will occur when a new organizer calls this function and tries to withdraw ETH / Proceeds ,in the end it will fail because of the onlyOwner Modifier
Impact:
The New Organizer gets a failed transaction everytime they call the
FestivalPass::Withdrawfunction
Proof of Concept
Recommended Mitigation
- // Organizer withdraws ETH
function withdraw(address target) external onlyOwner {
payable(target).transfer(address(this).balance);
}
Rewards breakdown
nSLOC
234This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.