Root + Impact

The withdrawAllFailedCredits function accepts a _receiver parameter but uses msg.sender when resetting balances and sending funds. This inconsistent use of _receiver and msg.sender creates an authorization flaw, enabling attackers to redirect another user’s credits to themselves.

Description

• The withdrawAllFailedCredits function accepts an _receiver parameter but incorrectly uses msg.sender for both resetting the failedTransferCredits mapping and sending funds. This allows any attacker to steal other users' failed transfer credits by calling withdrawAllFailedCredits with a victim's address as the _receiver parameter. The function will check the victim's balance, reset msg.sender's balance (which is likely 0), and then attempt to send the victim's funds to msg.sender.

Risk

Likelihood:

• This occurs whenever a user has accumulated ETH in failedTransferCredits due to failed refunds, settlements, or withdrawals.

• An attacker can always exploit this by passing a victim’s address as _receiver and receiving the victim’s funds, since no authorization checks prevent it.

Impact:

• Attackers can steal all failed transfer credits belonging to any user. This could result in complete loss of funds for users who have accumulated credits from failed ETH transfers during bid refunds, auction settlements, or fee withdrawals.

Proof of Concept

Recommended Mitigation

To validate that only valid user can withdraw own credit we need to add one line of code to validate.

require(msg.sender == _receiver, "Can only withdraw own credits");