Last Man Standing
First Flight #45
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: medium
Invalid

Ether Locked in Fallback `receive()`

jufel

Description:
The receive() function unconditionally accepts ETH without updating pot or platformFeesBalance. Any ETH sent directly to the contract (e.g., via send/transfer/selfdestruct) becomes “stuck” in the contract balance but is not credited to any on-chain accounting.

Impact:

  • Fund Loss: Users may accidentally send ETH that can never be withdrawn by anyone.

  • Accounting Mismatch: address(this).balance no longer equals pot + platformFeesBalance, causing confusion.

Proof of Concept: Add the following test to the 'Game.t.sol':

function testFallbackFundsAreLocked() public {
// Player sends 1 ether directly
payable(address(game)).transfer(1 ether);
// Contract balance increased
assertEq(address(game).balance, 1 ether);
// Pot remains zero
assertEq(game.pot(), 0);
// Platform fees remain zero
assertEq(game.platformFeesBalance(), 0);
}

Mitigation:
Reject direct transfers:

receive() external payable {
+ revert("Game: Please use claimThrone() to participate.");
}
Updates

Appeal created

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Direct ETH transfers - User mistake

There is no reason for a user to directly send ETH or anything to this contract. Basic user mistake, info, invalid according to CH Docs.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!