Beatland Festival
First Flight #44
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: high
Invalid

Unrestricted withdraw Function Allows Anyone to Drain Festival Funds

gurmeetkalyan

Root + Impact

Description:

The withdraw() function is publicly accessible and transfers all USDC/USDT balances from the contract to the organizer. There is no access control or role check restricting who can call this function.

function withdraw() external {
uint256 usdcBal = usdc.balanceOf(address(this));
uint256 usdtBal = usdt.balanceOf(address(this));
usdc.transfer(organizer, usdcBal);
usdt.transfer(organizer, usdtBal);
}

// Root cause in the codebase with @> marks to highlight the relevant section

function withdraw() @> external <@ {
...
}

Risk

Likelihood:

  • This will happen as soon as any user calls the withdraw() function, which is not restricted to the organizer.

  • In a deployed environment, any on-chain scanner or MEV bot could instantly exploit it.

Impact:

  • All stablecoin balances (USDC/USDT) held by the contract can be drained by anyone.

  • Permanent and irreversible loss of funds, directly impacting the protocol's treasury and participants.

  • Critical financial vulnerability with likely real-world consequences.

Proof of Concept

FestivalPass festival = FestivalPass(festivalAddress);
festival.withdraw(); // called by anyone
// organizer receives funds, but the caller is not checked

Simulation using a script:

await festival.connect(attacker).withdraw();
// attacker doesn't need any role or permission

Recommended Mitigation

- function withdraw() external {
+ function withdraw() external onlyOrganizer {

Also, enforce proper onlyOrganizer modifier:

modifier onlyOrganizer() {
require(msg.sender == organizer, "Not organizer");
_;
}

Add this modifier to all functions that affect treasury/fund movement.

Updates

Lead Judging Commences

inallhonesty Lead Judge
about 1 month ago
inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.