Last Man Standing
First Flight #45
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: medium
Invalid

Unaccounted ETH Sent Directly to Contract Cannot Be Withdrawn

blazex

Description

  • The contract includes a receive() function that allows it to accept ETH sent directly without any specific action, which should ideally be handled as part of gameplay mechanics like claimThrone().

  • ETH sent this way increases the contract’s balance but is not added to pot or platformFeesBalance, making it unaccounted for and unwithdrawable by the winner or owner, effectively locking those funds in the contract.

//@> receive() external payable {}

Risk

Likelihood:

  • This occurs whenever a user or external contract mistakenly sends ETH directly to the contract address instead of using claimThrone().

  • Such mistakes can happen due to user error or misconfigured interactions, which are plausible in decentralized applications.

Impact:

  • Funds sent directly become permanently stuck, resulting in a loss for the sender without benefiting the game’s pot or platform fees.

  • This reduces trust in the contract and may confuse participants about the actual prize pool.

Proof of Concept

// 1. A user sends 1 ETH directly to the contract address:
payable(address(Game)).transfer(1 ether);
// 2. Contract balance increases by 1 ETH, but pot and platformFeesBalance remain unchanged.
// 3. Winner withdraws pendingWinnings, which excludes the 1 ETH.
// 4. Owner withdraws platformFeesBalance, which also excludes the 1 ETH.
// 5. The 1 ETH remains locked in the contract.

Recommended Mitigation

Prevent direct ETH transfers by reverting them:

- receive() external payable {}
+ receive() external payable {
+ revert("Direct ETH transfers are not allowed. Use claimThrone() to participate.");
+ }
Updates

Appeal created

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Direct ETH transfers - User mistake

There is no reason for a user to directly send ETH or anything to this contract. Basic user mistake, info, invalid according to CH Docs.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.