Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: medium
Invalid

Incorrect Fee Withdrawal Logic Could Lead to Loss if onlyOwner Changes

eagerpanda582

Root + Impact

Description

  • Imagine in the future the contract changes ownership or onlyOwner is updated (e.g., to allow multiple admins).

Then msg.sender might be a valid caller (per onlyOwner) but not necessarily the owner anymore.

  • Using owner() explicitly forces the fee to go to the current owner, not the caller.

function withdrawFee() external onlyOwner {
uint256 feeToWithdraw = s_totalFee;
require(feeToWithdraw > 0, "No fees to withdraw");
s_totalFee = 0;
@==> _payout(owner(), feeToWithdraw);
emit FeeWithdrawn(feeToWithdraw);

Risk

Likelihood:

  • Medium – only occurs if the ownership or onlyOwner logic is modified.



    Impact:

  • Loss of funds for the intended fee recipient.


Recommended Mitigation

- _payout(owner(), feeToWithdraw);
+ _payout(msg.sender, feeToWithdraw);
​
Updates

Lead Judging Commences

cryptoghost Lead Judge 2 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!