Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

WithdrawAllFailedCredits Logic Weakness

eagerpanda582

Root + Impact

Description

  • The amount is taken from _receiver, but reset on msg.sender.

    • If msg.sender != _receiver, mapping may not be reset correctly.

    • This allows griefing or prevents correct withdrawals.

      @==> function withdrawAllFailedCredits(address _receiver) external {
      uint256 amount = failedTransferCredits[_receiver];
      require(amount > 0, "No credits to withdraw");
      failedTransferCredits[msg.sender] = 0;
      @==> (bool success, ) = payable(msg.sender).call{value: amount}("");
      require(success, "Withdraw failed");
      }

Likelihood:

  • his will occur whenever msg.sender != _receiver.

Any user can call this function with an arbitrary _receiver argument.

Impact:

  • Incorrect Withdrawals – Credits belonging to _receiver can be withdrawn by msg.sender if they trick the system.

User Confusion – The system may display that _receiver still has credits, but they are drained by someone else.

Proof of Concept

Alice has failedTransferCredits[Alice] = 1 ether.
​
Bob calls:
​
market.withdrawAllFailedCredits(Alice);
​
Code executes:
​
amount = failedTransferCredits[Alice] = 1 ether
​
Clears failedTransferCredits[Bob] = 0 (instead of Alice)
​
Sends Alice’s 1 ether to Bob.
​
Alice is permanently unable to recover her funds.

Recommended Mitigation

- function withdrawAllFailedCredits(address _receiver) external {
- uint256 amount = failedTransferCredits[_receiver];
- require(amount > 0, "No credits to withdraw");
- failedTransferCredits[msg.sender] = 0;
- (bool success, ) = payable(msg.sender).call{value: amount}("");
- require(success, "Withdraw failed");
- }
+ function withdrawAllFailedCredits() external {
+ uint256 amount = failedTransferCredits[msg.sender];
+ require(amount > 0, "No credits to withdraw");
+ failedTransferCredits[msg.sender] = 0;
+ (bool success, ) = payable(msg.sender).call{value: amount}("");
+ require(success, "Withdraw failed");
+ }
​
Updates

Lead Judging Commences

cryptoghost Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeast Marketplace: Unrestricted FailedCredits Withdrawal

withdrawAllFailedCredits allows any user to withdraw another account’s failed transfer credits due to improper use of msg.sender instead of _receiver for balance reset and transfer.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!