Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Silent handling of failed ETH transfers in _payout:

eagerpanda582

Root + Impact

Description

  • Normal behavior: The _payout function sends ETH to a recipient using a low-level .call. If the transfer fails (e.g., recipient is a smart contract that rejects ETH), the amount is credited in failedTransferCredits.

Issue: The function does not provide any immediate feedback to the caller when a payout fails. There is no event emitted, and the caller cannot tell whether the transfer succeeded or failed unless they manually check the mapping. This may lead to confusion and lost funds.

function _payout(address recipient, uint256 amount) internal {
if (amount == 0) return;
(bool success, ) = payable(recipient).call{value: amount}("");
if (!success) {
failedTransferCredits[recipient] += amount; // @> silent crediting, no message to caller
}
}

Risk

Likelihood:

  • Any payout to a smart contract that rejects ETH (no payable fallback/receive) will trigger this silently.

Occurs in common scenarios: failed seller payouts, fee withdrawals, overpay refunds, etc.

Impact:

  • Funds may remain in the contract indefinitely if recipients never claim from failedTransferCredits.

Proof of Concept

Not Required.

Recommended Mitigation

+ event FailedPayout(address indexed recipient, uint256 amount);
​
function _payout(address recipient, uint256 amount) internal returns (bool) {
if (amount == 0) return true;
(bool success, ) = payable(recipient).call{value: amount}("");
if (!success) {
failedTransferCredits[recipient] += amount;
+ emit FailedPayout(recipient, amount); // Notify caller/off-chain
}
Updates

Lead Judging Commences

cryptoghost Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts Marketplace: Incorrect Event Emission

placeBid emits AuctionSettled even though the auction hasn’t ended, causing misleading event logs.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!